python3Packages.{google-cloud-artifact-registry: 1.22.0 -> 1.23.0,google-cloud-compute: 1.42.0 -> 1.56.0} (#581842)

Co-authored-by: K900 <me@0upti.me>

maintainers/scripts/haskell/regenerate-hackage-packages.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -E 'with import ../../.. {}; mkShell { packages = [ bash coreutils haskellPackages.cabal2nix-unstable.bin git (import ../../../ci {}).fmt.pkg ]; }'
+#! nix-shell -i bash -I nixpkgs=. -p bash coreutils haskellPackages.cabal2nix-unstable.bin git "(import <nixpkgs/ci> {}).fmt.pkg"
 
 set -euo pipefail
 

maintainers/scripts/haskell/update-cabal2nix-unstable.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -E 'with import ../../.. {}; mkShell { packages = [ bash coreutils curl jq gnused haskellPackages.cabal2nix-unstable.bin nix-prefetch-scripts (import ../../../ci {}).fmt.pkg ]; }'
+#! nix-shell -i bash -I nixpkgs=. -p bash coreutils curl jq gnused haskellPackages.cabal2nix-unstable.bin nix-prefetch-scripts "(import <nixpkgs/ci> {}).fmt.pkg"
 
 # Updates cabal2nix-unstable to the latest master of the nixos/cabal2nix repository.
 # See regenerate-hackage-packages.sh for details on the purpose of this script.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -81,6 +81,8 @@
 
 - [devenv](https://devenv.sh/), fast, declarative, reproducible and composable developer environments. Available as [programs.devenv](#opt-programs.devenv.enable).
 
+- [Yopass](https://yopass.se/), a secure way to share secrets, passwords and files. Available as [services.yopass](#opt-services.yopass.enable).
+
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
 
 - [udp514-journal](https://github.com/eworm-de/udp514-journal), a service to forward remote syslog messages to systemd-journal. Available as [services.udp514-journal](#opt-services.udp514-journal.enable).

nixos/modules/module-list.nix

@@ -1897,6 +1897,7 @@
   ./services/web-apps/windmill.nix
   ./services/web-apps/wordpress.nix
   ./services/web-apps/writefreely.nix
+  ./services/web-apps/yopass.nix
   ./services/web-apps/your_spotify.nix
   ./services/web-apps/youtrack.nix
   ./services/web-apps/zabbix.nix

nixos/modules/services/web-apps/yopass.nix

@@ -0,0 +1,159 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.yopass;
+
+  stateDirectory = "/var/lib/yopass";
+
+  # yopass-server has no config file: every flag is read from an
+  # environment variable of the same name (upstream
+  # docs/server-options.md). List-valued flags such as TRUSTED_PROXIES
+  # are parsed as comma-separated strings.
+  toEnvValue =
+    v:
+    if lib.isBool v then
+      lib.boolToString v
+    else if lib.isList v then
+      lib.concatMapStringsSep "," toString v
+    else
+      toString v;
+in
+{
+  options.services.yopass = {
+    enable = lib.mkEnableOption "Yopass, a secure way to share secrets and files";
+
+    package = lib.mkPackageOption pkgs "yopass" { };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/yopass";
+      description = ''
+        Path to a file in systemd `EnvironmentFile` format, for
+        settings that shouldn't land in the Nix store: `API_TOKEN`,
+        `WEBHOOK_SECRET`, `LICENSE_KEY`, `OIDC_CLIENT_SECRET`,
+        `OIDC_SESSION_KEY`.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (oneOf [
+          bool
+          int
+          str
+          (listOf str)
+        ]);
+      default = { };
+      example = {
+        PORT = 8080;
+        DATABASE = "redis";
+        REDIS = "redis://127.0.0.1:6379/0";
+        MAX_FILE_SIZE = "10MB";
+        TRUSTED_PROXIES = [
+          "192.168.1.0/24"
+          "10.0.0.0/8"
+        ];
+      };
+      description = ''
+        yopass-server settings, passed as environment variables. Every
+        flag in [the upstream documentation](https://github.com/jhaals/yopass/blob/master/docs/server-options.md)
+        has an environment variable form (`--oidc-issuer` is
+        `OIDC_ISSUER`); use that name as the attribute. Booleans become
+        `true`/`false`, numbers are stringified and lists are joined
+        with commas. Anything left unset keeps yopass-server's own
+        default, except that the module binds `ADDRESS` to `127.0.0.1`
+        (expecting a reverse proxy in front) and points
+        `FILE_STORE_PATH` at `/var/lib/yopass/files` so uploads survive
+        restarts; both can be overridden here.
+
+        A `FILE_STORE_PATH` outside `/var/lib/yopass` is allow-listed
+        for writing automatically, but it must already exist and be
+        writable by the service, which runs as a dynamic user.
+
+        The module doesn't own the storage backend. With `DATABASE =
+        "redis"` pointing at a local `services.redis.servers.<name>`,
+        add `systemd.services.yopass.after = [ "redis-<name>.service" ];`
+        yourself to avoid a startup race; the memcached unit name is
+        fixed, so that ordering is handled for you.
+
+        Secrets belong in {option}`services.yopass.environmentFile`
+        rather than here, since this ends up in the Nix store.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.yopass.settings = {
+      ADDRESS = lib.mkDefault "127.0.0.1";
+      # Upstream defaults to /tmp/yopass-files, which lands on the unit's
+      # PrivateTmp and is wiped on every restart.
+      FILE_STORE_PATH = lib.mkDefault "${stateDirectory}/files";
+    };
+
+    systemd.services.yopass = {
+      description = "Yopass - Share secrets securely";
+      documentation = [ "https://github.com/jhaals/yopass" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ]
+      ++ lib.optional ((cfg.settings.DATABASE or "memcached") == "memcached") "memcached.service";
+
+      environment = lib.mapAttrs (_: toEnvValue) cfg.settings;
+
+      serviceConfig = {
+        ExecStart = lib.getExe' cfg.package "yopass-server";
+        DynamicUser = true;
+        Restart = "on-failure";
+        EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+        StateDirectory = baseNameOf stateDirectory;
+        # StateDirectory is writable already; anything else needs
+        # allow-listing under ProtectSystem=strict.
+        ReadWritePaths = lib.optional (
+          !lib.hasPrefix "${stateDirectory}/" cfg.settings.FILE_STORE_PATH
+        ) cfg.settings.FILE_STORE_PATH;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @setuid @keyring"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ fraggerfox ];
+}

nixos/tests/all-tests.nix

@@ -2055,6 +2055,7 @@ in
     inherit lib runTest;
   };
   yggdrasil = runTest ./yggdrasil.nix;
+  yopass = import ./web-apps/yopass.nix { inherit pkgs runTest; };
   your_spotify = runTest ./your_spotify.nix;
   zammad = runTest ./zammad.nix;
   zapret2 = runTest ./zapret2.nix;

nixos/tests/web-apps/yopass.nix

@@ -0,0 +1,74 @@
+{
+  runTest,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (pkgs) lib;
+  yopassCli = lib.getExe pkgs.yopass;
+
+  yopassTest =
+    { name, backend }:
+    runTest {
+      name = "yopass-${name}";
+      meta.maintainers = with lib.maintainers; [ fraggerfox ];
+
+      nodes.machine =
+        { ... }:
+        {
+          services.memcached.enable = backend == "memcached";
+          services.redis.servers.yopass = lib.mkIf (backend == "redis") {
+            enable = true;
+            # Named instances default to port 0 (Unix socket only); yopass
+            # connects over TCP via a redis:// URL, so this needs enabling.
+            port = 6379;
+          };
+
+          services.yopass = {
+            enable = true;
+            settings.DATABASE = backend;
+            # "localhost" resolves to the IPv6 loopback first in this VM,
+            # but services.redis.servers binds 127.0.0.1 (IPv4) only by
+            # default; point at it explicitly rather than fight DNS order.
+            settings.REDIS = lib.mkIf (backend == "redis") "redis://127.0.0.1:6379/0";
+          };
+
+          # The module can't infer this itself (see the settings
+          # description) since it doesn't own the backend -- wire it here,
+          # where the actual unit name (for this *named* redis instance)
+          # is known, to avoid a startup race.
+          systemd.services.yopass.after = lib.mkIf (backend == "redis") [ "redis-yopass.service" ];
+          systemd.services.yopass.requires = lib.mkIf (backend == "redis") [ "redis-yopass.service" ];
+        };
+
+      testScript = ''
+        start_all()
+        machine.wait_for_unit("yopass.service")
+        machine.wait_for_open_port(1337)
+        machine.succeed("curl --fail http://localhost:1337 | grep -qi yopass")
+
+        # Round-trip a secret through the real yopass CLI (ships in the
+        # same package as yopass-server), exercising create + retrieve
+        # against the running server rather than guessing the HTTP API.
+        link = machine.succeed(
+            "printf 'hello from the nixos test' |"
+            " ${yopassCli} --api http://localhost:1337 --url http://localhost:1337"
+        ).strip()
+        machine.succeed(
+            "${yopassCli} --api http://localhost:1337 --url http://localhost:1337"
+            f" --decrypt '{link}' | grep -q 'hello from the nixos test'"
+        )
+      '';
+    };
+in
+{
+  memcached = yopassTest {
+    name = "memcached";
+    backend = "memcached";
+  };
+  redis = yopassTest {
+    name = "redis";
+    backend = "redis";
+  };
+}

pkgs/applications/editors/vim/plugins/generated.nix

@@ -15120,6 +15120,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  pentatonic-nvim = buildVimPlugin {
+    pname = "pentatonic.nvim";
+    version = "0-unstable-2026-10-31";
+    src = fetchFromGitHub {
+      owner = "farbzen";
+      repo = "pentatonic.nvim";
+      rev = "fe3c350795baa9a7cabd1a9fa37198c6a4c30f05";
+      hash = "sha256-aahik42orj0OfyaSY43Ln14MaDosT92j8cWjUv6gyfI=";
+    };
+    meta.homepage = "https://github.com/farbzen/pentatonic.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   perfanno-nvim = buildVimPlugin {
     pname = "perfanno.nvim";
     version = "0-unstable-2026-01-20";
@@ -17433,6 +17447,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tacho-nvim = buildVimPlugin {
+    pname = "tacho.nvim";
+    version = "0.1.0";
+    src = fetchFromGitHub {
+      owner = "farbzen";
+      repo = "tacho.nvim";
+      tag = "v0.1.0";
+      hash = "sha256-lJbf9T6EsVYSadYn1aRprFgVWtwe7CEqdnCmUUE9K1M=";
+    };
+    meta.homepage = "https://github.com/farbzen/tacho.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   tagalong-vim = buildVimPlugin {
     pname = "tagalong.vim";
     version = "0.2.2-unstable-2026-09-30";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1078,6 +1078,7 @@ https://github.com/lewis6991/pckr.nvim/,,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
 https://github.com/toppair/peek.nvim/,,
+https://github.com/farbzen/pentatonic.nvim/,,
 https://github.com/t-troebst/perfanno.nvim/,,
 https://github.com/olimorris/persisted.nvim/,,
 https://github.com/folke/persistence.nvim/,,
@@ -1243,6 +1244,7 @@ https://github.com/gcmt/taboo.vim/,,
 https://github.com/abecodes/tabout.nvim/,,
 https://github.com/Shougo/tabpagebuffer.vim/,,
 https://github.com/godlygeek/tabular/,,
+https://github.com/farbzen/tacho.nvim/,,
 https://github.com/AndrewRadev/tagalong.vim/,,
 https://github.com/preservim/tagbar/,,
 https://github.com/vim-scripts/taglist.vim/,,

pkgs/by-name/ag/agent-browser/package.nix

@@ -18,18 +18,18 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "agent-browser";
-  version = "0.39.1";
+  version = "0.41.0";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "agent-browser";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WIg6WAnk3728NrZVh8JYtu2iRoHi8lYT2e5CDgOg2Sc=";
+    hash = "sha256-siJ37qavluO6psfgaNTFkOSmL5f+PATFlPNWS7PXF6U=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/cli";
 
-  cargoHash = "sha256-f+7fTDs/irnf/6jCmSlSKaIaVAuqmTvjhW/vBT5gBKM=";
+  cargoHash = "sha256-YMLJ6ykf4IQNDjCNP3E6E5Rj+gLYe9INysbnVFaeqQA=";
 
   # Place the pre-built dashboard where RustEmbed expects it
   postUnpack = ''

pkgs/by-name/al/albyhub/ldk-node/default.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   cmake,
   llvmPackages,
+  sqlite,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -30,6 +31,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rustPlatform.bindgenHook
   ];
 
+  buildInputs = [ sqlite ];
+
   # Add CFLAGS to suppress the stringop-overflow error during aws-lc-sys compilation.
   NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow";
 

pkgs/by-name/an/android-file-transfer/darwin-dont-vendor-dependencies.patch

@@ -0,0 +1,21 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 574b354..1a62874 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -254,16 +254,6 @@ endif()
+ 
+ if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
+ 	set(MACOSX_BUNDLE_LIBS)
+-	if (OPENSSL_FOUND)
+-		list(APPEND MACOSX_BUNDLE_LIBS /usr/local/opt/openssl@1.1/lib/libcrypto.1.1.dylib)
+-	endif()
+-	if (TAGLIB_FOUND)
+-		list(APPEND MACOSX_BUNDLE_LIBS /usr/local/opt/taglib/lib/libtag.2.dylib)
+-	endif()
+-	if (FUSE_FOUND)
+-		list(APPEND MACOSX_BUNDLE_LIBS /usr/local/lib/libosxfuse.2.dylib)
+-	endif()
+-
+ 	set(MACOSX_BUNDLE_LIBS_INSTALL)
+ 	set(MACOSX_BUNDLE_ROOT_DIR "${CMAKE_INSTALL_PREFIX}/${CMAKE_PROJECT_NAME}.app")
+ 	message(STATUS "bundle root dir: ${MACOSX_BUNDLE_ROOT_DIR}")

pkgs/by-name/an/android-file-transfer/package.nix

@@ -20,12 +20,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-Ogq8aTOZvZTfceJuQ1vSjl5Lm5Ww/8jTUZwcXkDDaxI=";
   };
 
+  patches = [ ./darwin-dont-vendor-dependencies.patch ];
+
   nativeBuildInputs = [
     cmake
     readline
     pkg-config
     qt6.wrapQtAppsHook
   ];
+
   buildInputs = [
     fuse3
     qt6.qtbase
@@ -41,7 +44,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Reliable MTP client with minimalistic UI";
     homepage = "https://whoozle.github.io/android-file-transfer-linux/";
     license = lib.licenses.lgpl21Plus;
-    maintainers = [ lib.maintainers.xaverdh ];
+    maintainers = with lib.maintainers; [
+      azuwis
+      xaverdh
+    ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/aw/aws-lc/fix-dynamic-loading-test.patch

@@ -0,0 +1,94 @@
+diff --git i/crypto/CMakeLists.txt w/crypto/CMakeLists.txt
+index 7bac21b..da56759 100644
+--- i/crypto/CMakeLists.txt
++++ w/crypto/CMakeLists.txt
+@@ -895,20 +895,23 @@ if(BUILD_TESTING)
+   add_dependencies(${DYNAMIC_LOADING_TEST_EXEC} crypto)
+   set_test_location(${DYNAMIC_LOADING_TEST_EXEC})
+ 
+   set(DYNAMIC_LINKER_LIB "")
+   if(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR APPLE OR ANDROID)
+     set(DYNAMIC_LINKER_LIB "dl")
+   endif()
+ 
+   if (BUILD_SHARED_LIBS AND NOT WIN32)
+     target_compile_options(${DYNAMIC_LOADING_TEST_EXEC} PUBLIC "-DLIBCRYPTO_PATH=\"$<TARGET_FILE:crypto>\"")
++    if(BORINGSSL_PREFIX)
++      target_compile_options(${DYNAMIC_LOADING_TEST_EXEC} PUBLIC "-DSYMBOL_PREFIX=\"${BORINGSSL_PREFIX}_\"")
++    endif()
+     # Do not link to boringssl_gtest_main or any library that might be linked to libcrypto.so.
+     if(ANDROID)
+       target_link_libraries(${DYNAMIC_LOADING_TEST_EXEC} PUBLIC boringssl_gtest ${DYNAMIC_LINKER_LIB})
+     else()
+       target_link_libraries(${DYNAMIC_LOADING_TEST_EXEC} PUBLIC boringssl_gtest pthread ${DYNAMIC_LINKER_LIB})
+     endif()
+   endif()
+ 
+   add_dependencies(all_tests ${DYNAMIC_LOADING_TEST_EXEC})
+ 
+diff --git i/crypto/dynamic_loading_test.c w/crypto/dynamic_loading_test.c
+index 4c37c28..88002dc 100644
+--- i/crypto/dynamic_loading_test.c
++++ w/crypto/dynamic_loading_test.c
+@@ -20,53 +20,57 @@
+ 
+ #include <stdio.h>
+ 
+ #ifdef LIBCRYPTO_PATH
+ 
+ #include <stdint.h>
+ #include <stdlib.h>
+ #include <dlfcn.h>
+ #include <pthread.h>
+ 
++#ifndef SYMBOL_PREFIX
++#define SYMBOL_PREFIX ""
++#endif
++
+ typedef void (*fp_lc_clear_error_t)(void);
+ typedef int (*fp_lc_tl_func_t)(void);
+ typedef int (*fp_rand_bytes_t)(uint8_t *buf, size_t len);
+ 
+ #define BUFFER_SIZE 16
+ #define TEST_ITERS 10
+ #define THREAD_COUNT 10
+ 
+ static void *cycle_thread_local_setup(void *lc_so) {
+   uint8_t buffer[BUFFER_SIZE];
+-  fp_lc_clear_error_t lc_clear_error = dlsym(lc_so, "ERR_clear_error");
+-  fp_rand_bytes_t lc_rand_bytes = dlsym(lc_so, "RAND_bytes");
+-  fp_lc_tl_func_t lc_tl_clear = dlsym(lc_so, "AWSLC_thread_local_clear");
++  fp_lc_clear_error_t lc_clear_error = dlsym(lc_so, SYMBOL_PREFIX "ERR_clear_error");
++  fp_rand_bytes_t lc_rand_bytes = dlsym(lc_so, SYMBOL_PREFIX "RAND_bytes");
++  fp_lc_tl_func_t lc_tl_clear = dlsym(lc_so, SYMBOL_PREFIX "AWSLC_thread_local_clear");
+ 
+   for (int i = 0; i < TEST_ITERS; i++) {
+     (*lc_clear_error)();
+     if (1 != (*lc_rand_bytes)(buffer, BUFFER_SIZE)) {
+       fprintf(stderr, "Call to RAND_bytes failed.");
+       exit(1);
+     }
+     if (1 != (*lc_tl_clear)()) {
+       fprintf(stderr, "Call to AWSLC_thread_local_clear failed.");
+       exit(1);
+     }
+   }
+ 
+   return NULL;
+ }
+ 
+ static void *load_unload(void *ctx) {
+   const char* path = ctx;
+   void *lc_so = dlopen(path, RTLD_NOW);
+-  fp_lc_tl_func_t lc_tl_shutdown = dlsym(lc_so, "AWSLC_thread_local_shutdown");
++  fp_lc_tl_func_t lc_tl_shutdown = dlsym(lc_so, SYMBOL_PREFIX "AWSLC_thread_local_shutdown");
+ 
+   pthread_t thread_id[THREAD_COUNT];
+   for (int i = 0; i < THREAD_COUNT; i++) {
+     if (pthread_create(&thread_id[i], NULL, cycle_thread_local_setup, lc_so)) {
+       fprintf(stderr, "Call to pthread_create in load_unload failed.");
+       exit(1);
+     }
+   }
+ 
+   // Also cycle on the current thread

pkgs/by-name/aw/aws-lc/fix-openssl-shim-symlinks.patch

@@ -0,0 +1,50 @@
+Commit ID: eaef466931b704cbded48be8c51f7a8fa75ca6e0
+Change ID: yxsyyzwrzkrtqvksxqsurozmktvqsssw
+Author   : Marie Ramlow <marie@marie.cologne> (2026-11-01 13:28:50)
+Committer: Marie Ramlow <marie@marie.cologne> (2026-11-01 13:29:10)
+
+    Fix OpenSSL-compat shim symlinks
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index aa64e1aa22..005dc11c58 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1844,12 +1844,12 @@
+     endif()
+     install(CODE "
+       execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
+-        lib${CRYPTO_LIB_NAME}.${SHIM_LIB_EXT} \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}/libcrypto.${SHIM_LIB_EXT}\")
++        lib${CRYPTO_LIB_NAME}.${SHIM_LIB_EXT} \"\$ENV{DESTDIR}${CMAKE_INSTALL_FULL_LIBDIR}/libcrypto.${SHIM_LIB_EXT}\")
+     " ${SHIM_LINK_COMPONENT})
+     if(BUILD_LIBSSL)
+       install(CODE "
+         execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
+-          lib${SSL_LIB_NAME}.${SHIM_LIB_EXT} \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}/libssl.${SHIM_LIB_EXT}\")
++          lib${SSL_LIB_NAME}.${SHIM_LIB_EXT} \"\$ENV{DESTDIR}/${CMAKE_INSTALL_FULL_LIBDIR}/libssl.${SHIM_LIB_EXT}\")
+       " ${SHIM_LINK_COMPONENT})
+     endif()
+   endif()
+@@ -1858,7 +1858,7 @@
+     # Always create the include directory symlink for OpenSSL compatibility
+     install(CODE "
+       execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
+-        aws-lc/openssl \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}/openssl\")
++        aws-lc/openssl \"\$ENV{DESTDIR}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/openssl\")
+     " COMPONENT Development)
+   endif()
+ endif()
+diff --git a/tool-openssl/CMakeLists.txt b/tool-openssl/CMakeLists.txt
+index 262b42aa00..6f16cfa198 100644
+--- a/tool-openssl/CMakeLists.txt
++++ b/tool-openssl/CMakeLists.txt
+@@ -191,8 +191,8 @@
+ if(INSTALL_OPENSSL_SHIM AND COHABITANT_BINARIES)
+   install(CODE "
+     execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
+-      \"${AWSLC_BIN_PREFIX}openssl\" \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/openssl\")
++      \"${AWSLC_BIN_PREFIX}openssl\" \"\$ENV{DESTDIR}/${CMAKE_INSTALL_FULL_BINDIR}/openssl\")
+     execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
+-      \"${AWSLC_BIN_PREFIX}c_rehash\" \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/c_rehash\")
++      \"${AWSLC_BIN_PREFIX}c_rehash\" \"\$ENV{DESTDIR}/${CMAKE_INSTALL_FULL_BINDIR}/c_rehash\")
+   ")
+ endif()

pkgs/by-name/aw/aws-lc/package.nix

@@ -2,18 +2,58 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  buildGoModule,
   cmake,
   ninja,
+  go,
+  perl,
   rust-bindgen,
   testers,
   nix-update-script,
+  aws-lc,
+  writableTmpDirAsHomeHook,
+  runCommand,
   useSharedLibraries ? !stdenv.hostPlatform.isStatic,
   withRustBindings ? true,
+  symbolPrefix ? "AWS_LC",
+  # This option might lead to OpenSSL being silently swapped to AWS-LC. Only use it if you know what you are doing.
+  withOpenSSLShim ? false,
 }:
+
+let
+  aws-lc' = aws-lc.override {
+    useSharedLibraries = false;
+    symbolPrefix = null;
+  };
+  symbols =
+    runCommand "aws-lc-symbols"
+      {
+        inherit (aws-lc) src;
+        nativeBuildInputs = [
+          writableTmpDirAsHomeHook
+          go
+        ];
+      }
+      ''
+        cd "$src"
+        go run ./util/read_symbols.go -out "$TMPDIR/symbols_crypto.txt" ${aws-lc'}/lib/libcrypto-awslc.a
+        go run ./util/read_symbols.go -out "$TMPDIR/symbols_ssl.txt" ${aws-lc'}/lib/libssl-awslc.a
+        cat "$TMPDIR"/symbols_{crypto,ssl}.txt > $out
+      '';
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
   version = "5.12.0";
 
+  patches = [
+    ./fix-dynamic-loading-test.patch
+    ./fix-openssl-shim-symlinks.patch
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
@@ -28,26 +68,51 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
+    writableTmpDirAsHomeHook
     cmake
     ninja
+    go
+    perl
   ]
   ++ lib.optionals withRustBindings [
     rust-bindgen
   ];
 
+  goDeps =
+    (buildGoModule {
+      inherit (finalAttrs) pname version src;
+      vendorHash = "sha256-495bUr3Cuo7kuhuNLMVhrVg9NXTAXyFmnXRmBrCHovA=";
+    }).goModules;
+
+  # it seems that ENABLE_DIST_PKG rejects apple because of symbol versioning,
+  # but we disable symbol versioning ourselves.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "if(NOT UNIX OR APPLE)" "if(NOT UNIX)"
+  '';
+
+  preConfigure = ''
+    ln -s ${finalAttrs.goDeps} vendor
+  '';
+
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" useSharedLibraries)
-    (lib.cmakeBool "DISABLE_GO" true)
-    (lib.cmakeBool "DISABLE_PERL" true)
     (lib.cmakeBool "GENERATE_RUST_BINDINGS" withRustBindings)
+    (lib.cmakeBool "ENABLE_DIST_PKG" true)
+    (lib.cmakeBool "ENABLE_DIST_PKG_OPENSSL_SHIM" withOpenSSLShim)
+    (lib.cmakeBool "ENABLE_SYMBOL_VERSIONING" false)
   ]
   ++ lib.optionals stdenv.cc.isGNU [
     # Needed with gcc but breaks with clang
     (lib.cmakeFeature "CMAKE_C_FLAGS" "-Wno-error=stringop-overflow")
+  ]
+  ++ lib.optionals (symbolPrefix != null) [
+    (lib.cmakeFeature "BORINGSSL_PREFIX" symbolPrefix)
+    (lib.cmakeFeature "BORINGSSL_PREFIX_SYMBOLS" (toString symbols))
   ];
 
   doCheck = true;
-  checkTarget = "run_minimal_tests";
+  checkTarget = "run_tests";
 
   postInstall = ''
     moveToOutput lib/crypto/cmake "$dev"
@@ -77,7 +142,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
-        command = "bssl version";
+        command = "aws-lc-bssl version";
       };
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
@@ -97,15 +162,14 @@ stdenv.mkDerivation (finalAttrs: {
         asl20
         isc
       ];
-    mainProgram = "bssl";
+    mainProgram = "aws-lc-bssl";
     maintainers = with lib.maintainers; [
       whispersofthedawn
     ];
     pkgConfigModules = [
       "aws-lc"
-      "libcrypto"
-      "libssl"
-      "openssl"
+      "libcrypto-awslc"
+      "libssl-awslc"
     ];
     platforms = lib.platforms.unix;
   };

pkgs/by-name/co/cocoon/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cocoon";
-  version = "0.13.2";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "haileyok";
     repo = "cocoon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lvRqf2BeP/ul6axI6oQ19ucQ+Hn2YUN1swB1o3t909U=";
+    hash = "sha256-pvbEXY/ps+XB/Peq3+R76D2zd06Y33W1xzrnDiXiqxI=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     "-X main.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-Dxbilj8A67jjOWqqkv4B1iekQ2oUg+5oVjP1ta4YOk0=";
+  vendorHash = "sha256-2MF2rB+7DSjaF1bmyC2TcNaHFLaBOk6BIBFVDevPnDA=";
 
   passthru = {
     tests = lib.optionalAttrs stdenvNoCC.hostPlatform.isLinux { inherit (nixosTests) cocoon; };

pkgs/by-name/dw/dwarf-fortress/package.nix

@@ -0,0 +1,8 @@
+{
+  dwarf-fortress-packages,
+  ...
+}@args:
+
+# The latest Dwarf Fortress with the default wrapper; see default.nix.
+# Override arguments are passed on to the wrapper.
+dwarf-fortress-packages.dwarf-fortress.override (removeAttrs args [ "dwarf-fortress-packages" ])

pkgs/by-name/fa/fastcrw/package.nix

@@ -3,7 +3,8 @@
   rustPlatform,
   fetchFromGitHub,
   cacert,
-  cmake,
+  aws-lc,
+  pkg-config,
   versionCheckHook,
   nix-update-script,
 }:
@@ -22,13 +23,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-VEbM7WvJHhfbbW+9c7fwl5NoFYmDvfQwVKR1R/S+JfU=";
 
-  # aws-lc-sys drives its C build through cmake and generates its bindings.
   nativeBuildInputs = [
-    cmake
     rustPlatform.bindgenHook
+    pkg-config
   ];
 
-  dontUseCmakeConfigure = true;
+  buildInputs = [ aws-lc ];
 
   # The crw-cli journeys drive the built binary against local mock servers, but
   # rustls still refuses to construct a client without a system trust store.
@@ -59,6 +59,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=scrape_with_impersonated_pin_400s_on_absent_tier_or_contradiction"
     "--skip=scrape_with_renderer_unavailable_returns_400"
     "--skip=v2_extract_blank_system_prompt_is_tolerated"
+
+    # racy test
+    "--skip=with_timeout_falls_back_to_default_client_on_invalid_user_agent"
   ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/gr/greptimedb/package.nix

@@ -2,10 +2,14 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  cmake,
+  aws-lc,
   pkg-config,
   protobuf,
   zlib,
+  zstd,
+  libgit2,
+  oniguruma,
+  rust-jemalloc-sys-unprefixed,
   nix-update-script,
   versionCheckHook,
 }:
@@ -42,16 +46,19 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   nativeBuildInputs = [
-    cmake
     pkg-config
     protobuf
     rustPlatform.bindgenHook
   ];
 
-  buildInputs = [ zlib ];
-
-  # cmake is here only to build the vendored C sources of aws-lc-sys
-  dontUseCmakeConfigure = true;
+  buildInputs = [
+    zlib
+    aws-lc
+    zstd
+    libgit2
+    oniguruma
+    rust-jemalloc-sys-unprefixed
+  ];
 
   env = {
     # Installed binaries are stripped during fixup, so delete.

pkgs/by-name/ha/haproxy/package.nix

@@ -25,10 +25,15 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [
 let
   sslPkgs = {
     inherit
-      aws-lc
       libressl
       openssl
       ;
+    aws-lc = aws-lc.override {
+      # HAProxy wants to link against -lssl and -lcrypto
+      withOpenSSLShim = true;
+      # HAProxy gets confused with symbol prefixing enabled
+      symbolPrefix = null;
+    };
   };
   sslPkg = sslPkgs.${sslLibrary};
 in

pkgs/by-name/hb/hblock/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hblock";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "hectorm";
     repo = "hblock";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cke3MppQm8p8B9+5IcvCplw6CtyRbgq46wHqli7U77I=";
+    hash = "sha256-IfLyP6lHTSCH7mRNO+6QcOm2yIJmW9v/g6dEgjPwvEg=";
   };
 
   buildInputs = [

pkgs/by-name/ji/jive/package.nix

@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "jive";
-  version = "7.46";
+  version = "8.1";
 
   src = fetchurl {
     url = "https://repo.maven.apache.org/maven2/org/tango-controls/Jive/${finalAttrs.version}/Jive-${finalAttrs.version}-jar-with-dependencies.jar";
-    hash = "sha256-AbxTRFi5dCsN/HENTI/o3hBQKZM+cFtJxT3A8RKpQM4=";
+    hash = "sha256-Rni1iUBjrWktwcopRIsBXYRHkJ6ce7p6LzeG0934Jqg=";
   };
 
   dontUnpack = true;

pkgs/by-name/li/libselinux/package.nix

@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ]
   ++ lib.optionals enablePython [
+    python3Packages.build
     python3Packages.pip
     python3Packages.setuptools
     python3Packages.wheel

pkgs/by-name/ls/lsp-plugins/package.nix

@@ -39,7 +39,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lsp-plugins";
-  version = "1.2.35";
+  version = "1.2.37";
 
   outputs = [
     "out"
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/lsp-plugins/lsp-plugins/releases/download/${finalAttrs.version}/lsp-plugins-src-${finalAttrs.version}.tar.gz";
-    hash = "sha256-LJXse7IZ1WHqPbNgUbbHMhM7zXZCb7g2sd2FDcS1u2w=";
+    hash = "sha256-rn8iskm0GjfbllIpriq3I3Mw+DJ5Np+ZYSd9i/ENLfQ=";
   };
 
   # By default, GStreamer plugins are installed right alongside GStreamer itself

pkgs/by-name/ma/matrix-authentication-service/package.nix

@@ -10,6 +10,7 @@
   pkg-config,
   sqlite,
   zstd,
+  aws-lc,
   stdenv,
   open-policy-agent,
   cctools,
@@ -63,6 +64,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildInputs = [
     sqlite
     zstd
+    aws-lc
   ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -87,19 +89,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail ./share/policy.wasm "$out/share/$pname/policy.wasm"
   '';
 
-  preBuild =
-    let
-      buildTarget = stdenv.buildPlatform.rust.rustcTarget;
-      buildTargetUnderscore = lib.replaceString "-" "_" buildTarget;
-    in
-    ''
-      make -C policies
-      (cd "$pnpmRoot" && npm run build)
-
-      # Fix aws-lc-sys cross-compilation
-      export CC_${buildTargetUnderscore}=$CC_FOR_BUILD
-      export CXX_${buildTargetUnderscore}=$CXX_FOR_BUILD
-    '';
+  preBuild = ''
+    make -C policies
+    (cd "$pnpmRoot" && npm run build)
+  '';
 
   # Adapted from https://github.com/element-hq/matrix-authentication-service/blob/v0.20.0/.github/workflows/build.yaml#L75-L84
   postInstall = ''

pkgs/by-name/mi/mise/package.nix

@@ -11,7 +11,9 @@
   direnv,
   git,
   pkg-config,
+  aws-lc,
   openssl,
+  zstd,
   cmake,
   cacert,
   tzdata,
@@ -42,7 +44,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    aws-lc
+    zstd
+    openssl
+  ];
 
   postPatch = ''
     patchShebangs --build \

pkgs/by-name/ni/nixos-container/nixos-container.pl

@@ -16,6 +16,7 @@ my $nixpkgsLib = "@lib@";
 
 my $nsenter = "@util-linux@/bin/nsenter";
 my $su = "@su@";
+my $chattr = "@chattr@";
 
 my $configurationDirectory = "@configurationDirectory@";
 my $stateDirectory = "@stateDirectory@";
@@ -208,7 +209,7 @@ sub clearContainerState {
 
     safeRemoveTree($profileDir) if -e $profileDir;
     safeRemoveTree($gcRootsDir) if -e $gcRootsDir;
-    system("chattr", "-i", "$root/var/empty") if -e "$root/var/empty";
+    system($chattr, "-i", "$root/var/empty") if -e "$root/var/empty";
     safeRemoveTree($root) if -e $root;
     unlink($configFile) or die;
 }

pkgs/by-name/ni/nixos-container/package.nix

@@ -4,6 +4,7 @@
   perl,
   shadow,
   util-linux,
+  e2fsprogs,
   installShellFiles,
   configurationDirectory ? "/etc/nixos-containers",
   stateDirectory ? "/var/lib/nixos-containers",
@@ -22,6 +23,7 @@ replaceVarsWith {
       p.IPCRun
     ]);
     su = "${shadow.su}/bin/su";
+    chattr = "${lib.getBin e2fsprogs}/bin/chattr";
     lib = "${path + "/lib"}";
 
     inherit configurationDirectory stateDirectory util-linux;

pkgs/by-name/pl/plexRaw/package.nix

@@ -14,7 +14,7 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.43.5.11029-6bf8af3f0";
+  version = "1.43.5.11079-b3b13e506";
   pname = "plexmediaserver";
 
   # Fetch the source
@@ -22,12 +22,12 @@ stdenv.mkDerivation rec {
     if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-        sha256 = "06zc87dhfns8gkmmmsaqdxbsbax95jwfzf7sxy0zlklwvccc52dj";
+        sha256 = "05q7403bdxa2fhwagsnjhv3k2gv5xzif8iwb18a49qw6z0bnpwwa";
       }
     else
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-        sha256 = "1q92fvkq6c2hlazgdmdklxdygmrjspjpz0rg30j8lcxyasadybjn";
+        sha256 = "01m2hwngl54nfq7gjiplkpp3in0z2iwq4ff4bj96wvg0jwfagsbl";
       };
   outputs = [
     "out"

pkgs/by-name/po/podman-tui/package.nix

@@ -3,19 +3,21 @@
   stdenv,
   fetchFromGitHub,
   buildGoModule,
-  testers,
   nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "podman-tui";
-  version = "1.11.3";
+  version = "2.0.0";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qeUYn9FDhuLaNjeJekmQYjR1PJJx4/sKBuxT5qOLCj8=";
+    hash = "sha256-01W3iG7WOKNKVMEjP4o53TiDOVqge91IrUWCx0hEUsQ=";
   };
 
   vendorHash = null;
@@ -28,10 +30,7 @@ buildGoModule (finalAttrs: {
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin "darwin";
 
-  ldflags = [
-    "-s"
-    "-w"
-  ];
+  ldflags = [ "-s" ];
 
   checkFlags =
     let
@@ -43,16 +42,21 @@ buildGoModule (finalAttrs: {
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
-  passthru.tests.version = testers.testVersion {
-    package = finalAttrs.finalPackage;
-    command = "HOME=$(mktemp -d) podman-tui version";
-    version = "v${finalAttrs.version}";
-  };
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+  versionCheckProgramArg = "version";
+
+  doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };
 
   meta = {
     homepage = "https://github.com/containers/podman-tui";
+    changelog = "https://github.com/containers/podman-tui/releases/tag/${finalAttrs.src.tag}";
     description = "Podman Terminal UI";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ aaronjheng ];

pkgs/by-name/th/thrift/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "thrift";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "thrift";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+o/2exHsunjQBGjXrNQ1pQ5TKV53++qCxIMeVyOh5QY=";
+    hash = "sha256-ZXGxpjqQq+qlxEDM4tWOF1hHGZsy3s/K0c2bIxMky10=";
   };
 
   postPatch = lib.optionalString (!finalAttrs.finalPackage.doCheck) ''

pkgs/by-name/tr/trusttunnel-endpoint/package.nix

@@ -6,6 +6,8 @@
   boringssl,
   cacert,
   python3,
+  aws-lc,
+  pkg-config,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -43,10 +45,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
+    pkg-config
   ];
 
   buildInputs = [
     boringssl
+    aws-lc
   ];
 
   nativeCheckInputs = [
@@ -54,6 +58,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     python3
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/we/wechat/darwin.nix

@@ -1,21 +1,22 @@
 {
-  pname,
-  version,
-  src,
-  meta,
-  passthru ? { },
   stdenvNoCC,
+  fetchurl,
   _7zz,
+
+  passthru,
+  pname,
+  meta,
+  ...
 }:
 
-stdenvNoCC.mkDerivation {
-  inherit
-    pname
-    version
-    src
-    meta
-    passthru
-    ;
+stdenvNoCC.mkDerivation (finalAttrs: {
+  inherit pname;
+
+  inherit (finalAttrs.passthru.source) version;
+  src = fetchurl finalAttrs.passthru.source.src;
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   # dmg is APFS formatted
   nativeBuildInputs = [ _7zz ];
@@ -30,4 +31,8 @@ stdenvNoCC.mkDerivation {
 
     runHook postInstall
   '';
-}
+
+  passthru = passthru finalAttrs;
+
+  meta = meta finalAttrs;
+})

pkgs/by-name/we/wechat/linux.nix

@@ -1,36 +1,219 @@
 {
-  pname,
-  version,
-  src,
-  meta,
-  passthru ? { },
-  appimageTools,
-}:
+  lib,
+  stdenv,
+  stdenvNoCC,
+  fetchurl,
 
-let
-  appimageContents = appimageTools.extract {
-    inherit pname version src;
-    postExtract = ''
-      patchelf --replace-needed libtiff.so.5 libtiff.so $out/opt/wechat/wechat
+  # native
+  autoPatchelfHook,
+  dpkg,
+  makeShellWrapper,
+  wrapGAppsHook3,
+
+  # runtime
+  alsa-lib,
+  at-spi2-core,
+  bzip2,
+  cairo,
+  cups,
+  dbus,
+  expat,
+  fontconfig,
+  glib,
+  gtk3,
+  libredirect,
+  libice,
+  libsm,
+  libx11,
+  libxcomposite,
+  libxcursor,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxrandr,
+  libglvnd,
+  libjack2,
+  libpulseaudio,
+  libxcb,
+  libxcb-keysyms,
+  libxkbcommon,
+  mesa,
+  nspr,
+  nss,
+  pango,
+  pipewire,
+  systemd,
+  util-linuxMinimal,
+  wayland,
+  xkeyboard-config,
+  zlib,
+
+  pname,
+  passthru,
+  meta,
+  ...
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  inherit pname;
+  inherit (finalAttrs.passthru.source) version;
+
+  # Try upstream first as Wayback Machine is slow in China (where most users are located)
+  src = fetchurl {
+    inherit (finalAttrs.passthru.source.src) url hash;
+    netrcPhase = ''
+      touch netrc
+
+      url=${lib.escapeShellArg finalAttrs.passthru.source.upstream.url}
+      crc=${lib.escapeShellArg finalAttrs.passthru.source.upstream."x-cos-hash-crc64ecma"}
+      ver=${lib.escapeShellArg finalAttrs.passthru.source.upstream."x-cos-version-id"}
+
+      if actual=$(curl -fsSIL -o /dev/null -w '%header{x-cos-hash-crc64ecma}:%header{x-cos-version-id}' "$url") && [[ "$actual" == "$crc:$ver" ]]; then
+        urls=("$url")
+      fi
     '';
   };
-in
-appimageTools.wrapAppImage {
-  inherit
-    pname
-    version
-    meta
-    passthru
-    ;
 
-  src = appimageContents;
+  strictDeps = true;
+  __structuredAttrs = true;
 
-  extraInstallCommands = ''
-    mkdir -p $out/share/applications
-    cp ${appimageContents}/wechat.desktop $out/share/applications/
-    mkdir -p $out/share/icons/hicolor/256x256/apps
-    cp ${appimageContents}/wechat.png $out/share/icons/hicolor/256x256/apps/
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    makeShellWrapper
+    wrapGAppsHook3
+  ];
 
-    substituteInPlace $out/share/applications/wechat.desktop --replace-fail AppRun wechat
+  buildInputs = [
+    (lib.getLib stdenv.cc.cc) # for libatomic, libstdc++
+
+    dbus
+    glib
+    systemd # for libudev
+
+    at-spi2-core
+    cairo
+    fontconfig
+    gtk3
+    libxkbcommon
+    xkeyboard-config
+    pango
+
+    libice
+    libsm
+    libx11
+    libxcomposite
+    libxcursor
+    libxdamage
+    libxext
+    libxfixes
+    libxrandr
+    libxcb
+    libxcb-keysyms
+
+    wayland
+
+    libglvnd
+    mesa # for libgbm
+
+    alsa-lib
+    libjack2
+    libpulseaudio
+    pipewire
+
+    cups
+
+    nspr
+    nss
+
+    bzip2
+    expat
+    zlib
+  ];
+
+  runtimeDependencies = [
+    alsa-lib
+    gtk3
+    libglvnd
+    libpulseaudio
+    libxcursor
+    pipewire
+    systemd
+    wayland
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    cp -r opt "$out/"
+    cp -r usr/share "$out/"
+
+    substituteInPlace "$out/share/applications/wechat.desktop" \
+      --replace-fail "/usr/bin/wechat" "wechat"
+
+    sed -i 's|^Icon=.*|Icon=wechat|' "$out/share/applications/wechat.desktop"
+
+    runHook postInstall
   '';
-}
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    mkdir -p "$out/bin"
+
+    makeShellWrapper "$out/opt/wechat/wechat" "$out/bin/wechat" \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix LD_PRELOAD : "${lib.getLib libredirect}/lib/libredirect.so" \
+      --prefix NIX_REDIRECTS : "/usr/bin/lsblk=${lib.getExe' util-linuxMinimal "lsblk"}" \
+      --set XKB_CONFIG_ROOT "${xkeyboard-config}/share/X11/xkb" \
+      --set XLOCALEDIR "${libx11}/share/X11/locale" \
+      --set-default QT_AUTO_SCREEN_SCALE_FACTOR 1 \
+      --run '
+        if [ -z "''${QT_QPA_PLATFORM:-}" ]; then
+          if [ -n "''${WAYLAND_DISPLAY:-}" ] || [ "''${XDG_SESSION_TYPE:-}" = wayland ]; then
+            export QT_QPA_PLATFORM=wayland
+            export QT_IM_MODULE=text-input-unstable-v3
+          else
+            export QT_QPA_PLATFORM=xcb
+
+            case "''${XMODIFIERS:-}" in
+              *@im=fcitx*)
+                export QT_IM_MODULE=fcitx
+                export GTK_IM_MODULE=fcitx
+                ;;
+              *@im=ibus*)
+                export QT_IM_MODULE=ibus
+                export GTK_IM_MODULE=ibus
+                export IBUS_USE_PORTAL=1
+                ;;
+            esac
+          fi
+        fi
+      '
+  '';
+
+  postFixup = ''
+    # ANGLE loads libGL.so.1 and libEGL.so.1 dynamically from the GPU process.
+    patchelf --add-needed "${libglvnd}/lib/libGL.so.1" \
+      --add-needed "${libglvnd}/lib/libEGL.so.1" \
+      "$out/opt/wechat/RadiumWMPF/runtime/WeChatAppEx"
+
+    # WMPF and VLC both ship libffmpeg.so, but WMPF requires its own ABI.
+    patchelf --replace-needed \
+      libffmpeg.so \
+      "$out/opt/wechat/RadiumWMPF/runtime/libffmpeg.so" \
+      "$out/opt/wechat/RadiumWMPF/runtime/WeChatAppEx"
+
+    wrapProgramShell "$out/opt/wechat/RadiumWMPF/runtime/WeChatAppEx" \
+      --run '
+        if [ -n "''${NIXOS_OZONE_WL:-}" ] && [ -n "''${WAYLAND_DISPLAY:-}" ]; then
+          export GDK_BACKEND=wayland
+          set -- --ozone-platform=wayland "$@"
+        fi
+      '
+  '';
+
+  passthru = passthru finalAttrs;
+
+  meta = meta finalAttrs;
+})

pkgs/by-name/we/wechat/package.nix

@@ -1,18 +1,67 @@
 {
   lib,
+  stdenv,
   stdenvNoCC,
-  callPackage,
   fetchurl,
-}:
 
+  # native
+  _7zz,
+  autoPatchelfHook,
+  dpkg,
+  makeShellWrapper,
+  wrapGAppsHook3,
+
+  # runtime
+  alsa-lib,
+  at-spi2-core,
+  bzip2,
+  cairo,
+  coreutils,
+  cups,
+  dbus,
+  expat,
+  fontconfig,
+  glib,
+  gtk3,
+  libredirect,
+  libice,
+  libsm,
+  libx11,
+  libxcomposite,
+  libxcursor,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxrandr,
+  libglvnd,
+  libjack2,
+  libpulseaudio,
+  libxcb,
+  libxcb-keysyms,
+  libxkbcommon,
+  mesa,
+  nspr,
+  nss,
+  pango,
+  pipewire,
+  systemd,
+  util-linuxMinimal,
+  wayland,
+  xkeyboard-config,
+  zlib,
+}@args:
 let
-  inherit (stdenvNoCC.hostPlatform) system isDarwin;
-
-  sources = lib.importJSON ./sources.json;
-  source = sources.${system} or (throw "Unsupported system: ${system}");
-
   pname = "wechat";
-  meta = {
+
+  passthru = finalAttrs: {
+    sources = lib.importJSON ./sources.json;
+    updateScript = ./update.py;
+    source =
+      finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
+        or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
+  };
+
+  meta = finalAttrs: {
     description = "Messaging and calling app";
     homepage = "https://www.wechat.com/en/";
     downloadPage = "https://linux.weixin.qq.com/en";
@@ -24,33 +73,11 @@ let
       prince213
     ];
     mainProgram = "wechat";
-    platforms = lib.attrNames sources;
+    platforms = lib.attrNames finalAttrs.passthru.sources;
   };
 
+  args' = args // {
+    inherit pname passthru meta;
+  };
 in
-callPackage (if isDarwin then ./darwin.nix else ./linux.nix) {
-  inherit pname meta;
-  inherit (source) version;
-  src =
-    if isDarwin then
-      fetchurl source.src
-    else
-      # Try upstream first as Wayback Machine is slow in China (where most users are located)
-      fetchurl {
-        inherit (source.src) url hash;
-        netrcPhase = ''
-          touch netrc
-
-          url=${lib.escapeShellArg source.upstream.url}
-          crc=${lib.escapeShellArg source.upstream."x-cos-hash-crc64ecma"}
-          ver=${lib.escapeShellArg source.upstream."x-cos-version-id"}
-
-          if actual=$(curl -fsSIL -o /dev/null -w '%header{x-cos-hash-crc64ecma}:%header{x-cos-version-id}' "$url") && [[ "$actual" == "$crc:$ver" ]]; then
-            urls=("$url")
-          fi
-        '';
-      };
-  passthru = {
-    updateScript = ./update.py;
-  };
-}
+if stdenvNoCC.hostPlatform.isDarwin then import ./darwin.nix args' else import ./linux.nix args'

pkgs/by-name/we/wechat/sources.json

@@ -9,25 +9,25 @@
   "x86_64-linux": {
     "version": "4.1.13.26",
     "src": {
-      "url": "https://web.archive.org/web/20261016045027id_/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage",
-      "hash": "sha256-RSYYC8qYASh5FZmvEi/0eVACpXFaUQ9qZUgOK+aHQkQ="
+      "url": "https://web.archive.org/web/20261012092649id_/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb",
+      "hash": "sha256-oNuMru6NHmz+CqXOWHECcPjXSpD/SSD1Oj/CKqCVb+k="
     },
     "upstream": {
-      "url": "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage",
-      "x-cos-hash-crc64ecma": "8546959459320172836",
-      "x-cos-version-id": "MTg0NDQ5NTIyNzg5OTU1OTExNTE"
+      "url": "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb",
+      "x-cos-hash-crc64ecma": "10867328176854818451",
+      "x-cos-version-id": "MTg0NDQ5NTIyNzg5NTUwNjk2Nzk"
     }
   },
   "aarch64-linux": {
     "version": "4.1.13.26",
     "src": {
-      "url": "https://web.archive.org/web/20261019063855id_/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.AppImage",
-      "hash": "sha256-Awe3ndJWX7C6w63S7e4QzrKjwgcSAOZriE4ZxM1I/0g="
+      "url": "https://web.archive.org/web/20261012095035id_/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb",
+      "hash": "sha256-N0cy7aiKbzp+TrMV5k5frHPvF5I9UE0kKWTxntG4DHU="
     },
     "upstream": {
-      "url": "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.AppImage",
-      "x-cos-hash-crc64ecma": "2533586403816119198",
-      "x-cos-version-id": "MTg0NDQ5NTIyNzg5NjUzODMzNTc"
+      "url": "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb",
+      "x-cos-hash-crc64ecma": "14009050578420750826",
+      "x-cos-version-id": "MTg0NDQ5NTIyNzg5MzMyNjI0NTY"
     }
   }
 }

pkgs/by-name/we/wechat/update.py

@@ -1,12 +1,11 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p "python3.withPackages (p: [ p.waybackpy ])" _7zz
+#! nix-shell -i python3 -p "python3.withPackages (p: [ p.waybackpy ])" dpkg
 
 import argparse
 import base64
 import hashlib
 import json
 import re
-import shutil
 import subprocess
 import sys
 import tempfile
@@ -24,9 +23,9 @@ UPDATE_CONFIG_URL = (
 )
 MACUPDATE_XML = "MacUpdate_universal.xml"
 
-LINUX_APPIMAGE_URLS = {
-    "x86_64-linux": "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage",
-    "aarch64-linux": "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.AppImage",
+LINUX_URLS = {
+    "x86_64-linux": "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb",
+    "aarch64-linux": "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb",
 }
 
 DMG_RE = re.compile(
@@ -133,46 +132,17 @@ def hash_file(path: Path) -> str:
     return f"sha256-{digest}"
 
 
-def extract_version_from_appimage(appimage_path: Path) -> str | None:
-    seven_z = shutil.which("7zz") or shutil.which("7z")
-    if not seven_z:
-        raise RuntimeError(
-            "Neither '7zz' nor '7z' was found in PATH. "
-            "Please ensure '_7zz' is available in PATH."
+def extract_version_linux(package_path: Path) -> str:
+    if package_path.suffix == ".deb":
+        proc = subprocess.run(
+            ["dpkg-deb", "-f", str(package_path), "Version"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+            check=True,
+            text=True,
         )
-
-    base_version = None
-    proc_desktop = subprocess.run(
-        [seven_z, "e", str(appimage_path), "wechat.desktop", "-so"],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.DEVNULL,
-    )
-    if proc_desktop.returncode == 0 and proc_desktop.stdout:
-        for line in proc_desktop.stdout.decode("utf-8", "ignore").splitlines():
-            if line.startswith("X-AppImage-Version="):
-                base_version = line.split("=", 1)[1].strip()
-                break
-
-    proc = subprocess.run(
-        [seven_z, "e", str(appimage_path), "opt/wechat/wechat", "-so"],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.DEVNULL,
-    )
-    if proc.returncode == 0 and proc.stdout:
-        if base_version:
-            pattern = re.escape(base_version.encode()) + rb"\.\d+"
-            matches = re.findall(pattern, proc.stdout)
-            if matches:
-                return matches[0].decode()
-        matches = re.findall(rb"\b\d+\.\d+\.\d+\.\d+\b", proc.stdout)
-        if matches:
-            valid = [match for match in matches if match.startswith(b"4.")]
-            if valid:
-                return max(
-                    valid, key=lambda match: tuple(map(int, match.split(b".")))
-                ).decode()
-
-    return base_version
+        return proc.stdout.strip()
+    raise NotImplementedError(f"Unsupported package format: {package_path.name}")
 
 
 def macupdate_package_url(config_xml: bytes) -> str:
@@ -279,7 +249,15 @@ def save_to_wayback(url: str) -> str:
     except Exception as exc:
         log(f"Wayback save request failed ({exc}); checking newest snapshot...")
         availability_api = waybackpy.WaybackMachineAvailabilityAPI(url, USER_AGENT)
-        saved_url = availability_api.newest().archive_url
+        saved_url = None
+        for attempt in range(5):
+            try:
+                saved_url = availability_api.newest().archive_url
+                break
+            except Exception:
+                if attempt == 4:
+                    raise
+                time.sleep(2)
     return format_wayback_url(saved_url)
 
 
@@ -329,10 +307,10 @@ def update_darwin(sources: dict) -> bool:
 
 
 def update_linux(platform: str, sources: dict) -> bool:
-    appimage_url = LINUX_APPIMAGE_URLS[platform]
+    url = LINUX_URLS[platform]
 
-    log(f"[{platform}] Checking upstream headers: {appimage_url}")
-    headers = fetch_head_headers(appimage_url)
+    log(f"[{platform}] Checking upstream headers: {url}")
+    headers = fetch_head_headers(url)
 
     current = sources.get(platform, {})
     current_upstream = current.get("upstream", {})
@@ -340,7 +318,9 @@ def update_linux(platform: str, sources: dict) -> bool:
     crc = headers.get("x-cos-hash-crc64ecma")
     version_id = headers.get("x-cos-version-id")
 
-    if crc is not None:
+    if current_upstream.get("url") != url:
+        is_unchanged = False
+    elif crc is not None:
         is_unchanged = current_upstream.get("x-cos-hash-crc64ecma") == crc
     elif version_id is not None:
         is_unchanged = current_upstream.get("x-cos-version-id") == version_id
@@ -353,23 +333,23 @@ def update_linux(platform: str, sources: dict) -> bool:
         )
         return False
 
-    log(f"[{platform}] Upstream updated or not recorded. Downloading AppImage...")
+    log(f"[{platform}] Upstream updated or not recorded. Downloading package...")
 
     with tempfile.TemporaryDirectory(prefix=f"wechat-update-{platform}-") as tmp:
-        appimage_path = Path(tmp) / Path(appimage_url).name
-        log(f"[{platform}] Downloading AppImage...")
-        download(appimage_url, appimage_path)
+        package_path = Path(tmp) / Path(url).name
+        log(f"[{platform}] Downloading package...")
+        download(url, package_path)
 
-        version = extract_version_from_appimage(appimage_path)
+        version = extract_version_linux(package_path)
         if not version:
             raise RuntimeError(f"Could not determine version for {platform}")
 
         log(f"[{platform}] Resolved version: {version}")
         log(f"[{platform}] Computing hash...")
-        hash_value = hash_file(appimage_path)
+        hash_value = hash_file(package_path)
 
     log(f"[{platform}] Archiving to Wayback Machine...")
-    archived_url = save_to_wayback(appimage_url)
+    archived_url = save_to_wayback(url)
     log(f"[{platform}] Archived URL: {archived_url}")
 
     sources[platform] = {
@@ -379,7 +359,7 @@ def update_linux(platform: str, sources: dict) -> bool:
             "hash": hash_value,
         },
         "upstream": {
-            "url": appimage_url,
+            "url": url,
             **({"x-cos-hash-crc64ecma": crc} if crc else {}),
             **({"x-cos-version-id": version_id} if version_id else {}),
         },

pkgs/by-name/xp/xpra/package.nix

@@ -104,14 +104,14 @@ let
 in
 effectiveBuildPythonApplication (finalAttrs: {
   pname = "xpra";
-  version = "6.5.4";
+  version = "6.5.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Xpra-org";
     repo = "xpra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TXqnheJjq3WZZffbEPjS5/u/02OlJkDJ9IqyCabYr1E=";
+    hash = "sha256-/QtrpTcVPCUzcPPTR5YXD9jhcZ2Qg6XZ1K3RGQ2XmVo=";
   };
 
   patches = [

pkgs/by-name/yo/yopass/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   makeBinaryWrapper,
   lib,
+  nixosTests,
 }:
 let
   version = "14.9.0";
@@ -41,6 +42,8 @@ buildGoModule (finalAttrs: {
       --add-flags "--asset-path ${website}"
   '';
 
+  passthru.tests = nixosTests.yopass;
+
   meta = {
     description = "Secure sharing of secrets, passwords and files";
     homepage = "https://github.com/jhaals/yopass";

pkgs/development/compilers/julia/default.nix

@@ -53,11 +53,11 @@ in
   );
   julia_113-bin = wrapJulia (
     callPackage (import ./generic-bin.nix {
-      version = "1.13.2";
+      version = "1.13.3";
       sha256 = {
-        x86_64-linux = "01vxs4ckil94q8n2jpdx7n9lm852bf8lqh4jvmgmc2mbj2cgrk9f";
-        aarch64-linux = "0a3ich81hyizibfrq18dhgq1kiyyhxs3jdi4x1rb4hid2riaqrmk";
-        aarch64-darwin = "11q3401j5nqdnk711z2inpra61705bl6k85ln0v100k5mdsrfc33";
+        x86_64-linux = "1r33bkw1657h37nns4d1lk597h6sypi7jxsfa2ivab1k815wnqaw";
+        aarch64-linux = "00yz3lbsz16xzjjh33dcizzvgag3bn9ddbs0pn4q3yvdxqxhbsww";
+        aarch64-darwin = "0r9pmp20lkq8z1z5sw5z65d6d4wrq0gzlhwb7sm95cxw1x2yiw5r";
       };
     }) { }
   );
@@ -141,8 +141,8 @@ in
   julia_113 = wrapJulia (
     callPackage
       (import ./generic.nix {
-        version = "1.13.2";
-        hash = "sha256-M3A6vzCiP13Sfk4a23/GbHwDrpiWE3bpwEZhyE04kik=";
+        version = "1.13.3";
+        hash = "sha256-E8TNBnli1sgf6mAIGSW+nimSpCBCicww3uPd2Wks8xs=";
         patches = [
           # Upstream only sets CMAKE_BUILD_RPATH on Darwin (JuliaLang/julia#63103).
           # On Linux in the Nix sandbox, intermediate build tools like llvm-min-tblgen

pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml

@@ -4725,6 +4725,7 @@ broken-packages:
   - pcf-font-embed # failure in job https://hydra.nixos.org/build/233246806 at 2023-09-02
   - pcgen # failure in job https://hydra.nixos.org/build/233195356 at 2023-09-02
   - PCLT # failure in job https://hydra.nixos.org/build/233246845 at 2023-09-02
+  - pcre-light # depends on pcre, which has been dropped from Nixpkgs
   - pcre-light-extra # failure in job https://hydra.nixos.org/build/233194585 at 2023-09-02
   - pcubature # failure in job https://hydra.nixos.org/build/253698476 at 2024-03-31
   - pdf-slave-template # failure in job https://hydra.nixos.org/build/233217870 at 2023-09-02
@@ -5336,6 +5337,7 @@ broken-packages:
   - regex-do # failure in job https://hydra.nixos.org/build/307521538 at 2025-09-19
   - regex-generator # failure in job https://hydra.nixos.org/build/233239502 at 2023-09-02
   - regex-parsec # failure in job https://hydra.nixos.org/build/233223781 at 2023-09-02
+  - regex-pcre # depends on pcre, which has been dropped from Nixpkgs
   - regex-posix-unittest # failure in job https://hydra.nixos.org/build/233249685 at 2023-09-02
   - regex-tdfa-pipes # failure in job https://hydra.nixos.org/build/233247416 at 2023-09-02
   - regex-tdfa-quasiquoter # failure in job https://hydra.nixos.org/build/233234166 at 2023-09-02

pkgs/development/haskell-modules/hackage-packages.nix

@@ -527571,6 +527571,8 @@ self: {
       ];
       description = "Portable regex library for Perl 5 compatible regular expressions";
       license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { pcre = null; };
 
@@ -587495,6 +587497,8 @@ self: {
       libraryPkgconfigDepends = [ pcre ];
       description = "PCRE Backend for \"Text.Regex\" (regex-base)";
       license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { pcre = null; };
 

pkgs/development/python-modules/cinemagoer/default.nix

@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
+  pyprojectVersionPatchHook,
   lxml,
   sqlalchemy,
   python,
@@ -26,6 +27,8 @@ buildPythonPackage {
 
   build-system = [ setuptools ];
 
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
   dependencies = [
     lxml
     sqlalchemy

pkgs/development/python-modules/google-cloud-artifact-registry/default.nix

@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-artifact-registry";
-  version = "1.22.0";
+  version = "1.23.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_artifact_registry";
     inherit version;
-    hash = "sha256-DoFzqXrmld/PAsgyd6D9V04aOb5AnaY0W5Rb6+V3rZQ=";
+    hash = "sha256-PeA29DdEMfdCp8FH6Bm7FgpU0JiuEcVnq2XvHfX9JzQ=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/google-cloud-compute/default.nix

@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-compute";
-  version = "1.42.0";
+  version = "1.56.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_compute";
     inherit version;
-    hash = "sha256-CLHbxXWLqlSRCHvO+1dOWdkRUgtxTtp5tOvxy0KdjZg=";
+    hash = "sha256-rWM5y65nl51skTH9eVy/rN657CTHjJwAcso3zDhfrjA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/gradio/client.nix

@@ -129,7 +129,7 @@ buildPythonPackage (finalAttrs: {
       doInstallCheck = false;
       doCheck = false;
       preCheck = "";
-      enabledTestPaths = [ ];
+      enabledTestPaths = null;
       disabledTestMarks = [ ];
       disabledTests = [ ];
       pythonImportsCheck = null;

pkgs/development/python-modules/json-schema-for-humans/default.nix

@@ -9,6 +9,7 @@
   jinja2,
   markdown2,
   poetry-core,
+  pyprojectVersionPatchHook,
   pygments,
   pytestCheckHook,
   pytz,
@@ -30,6 +31,8 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
   dependencies = [
     click
     dataclasses-json

pkgs/development/python-modules/planetary-computer/default.nix

@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pyprojectVersionPatchHook,
 
   # build-system
   setuptools,
@@ -41,6 +42,8 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
   dependencies = [
     click
     packaging

pkgs/development/python-modules/pydiffx/default.nix

@@ -23,6 +23,8 @@ buildPythonPackage rec {
   sourceRoot = "${src.name}/python";
 
   postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace-fail 'tag_build = .dev' 'tag_build ='
     substituteInPlace pydiffx/tests/testcases.py \
       --replace-fail "assertRaisesRegexp" "assertRaisesRegex"
   '';

pkgs/development/python-modules/pyfcm/default.nix

@@ -20,6 +20,11 @@ buildPythonPackage rec {
     hash = "sha256-lpSbb0DDXLHne062s7g27zRpvTuOHiqQkqGOtWvuWdI=";
   };
 
+  postPatch = ''
+    substituteInPlace pyfcm/__meta__.py \
+      --replace-fail '__version__ = "2.0.0"' '__version__ = "${version}"'
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [

pkgs/development/python-modules/pyqwest/default.nix

@@ -3,12 +3,12 @@
   buildPythonPackage,
   fetchFromGitHub,
 
-  # build-system
-  cmake,
   rustPlatform,
+  pkg-config,
 
   # dependencies
   opentelemetry-api,
+  pkgsHostTarget,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -39,20 +39,21 @@ buildPythonPackage (finalAttrs: {
   '';
 
   nativeBuildInputs = [
-    # Only invoked by aws-lc-sys' build script; there is no top-level
-    # CMakeLists.txt to configure.
-    cmake
+    pkg-config
     rustPlatform.bindgenHook
     rustPlatform.cargoSetupHook
     rustPlatform.maturinBuildHook
   ];
 
-  dontUseCmakeConfigure = true;
-
   dependencies = [
     opentelemetry-api
   ];
 
+  buildInputs = [
+    pkgsHostTarget.aws-lc
+    pkgsHostTarget.zstd
+  ];
+
   pythonImportsCheck = [ "pyqwest" ];
 
   # The test suite spins up local HTTP/1, HTTP/2 and HTTP/3 servers through

pkgs/development/python-modules/python-tsp/default.nix

@@ -5,6 +5,7 @@
   fetchFromGitHub,
   # Build system
   poetry-core,
+  pyprojectVersionPatchHook,
   # Dependencies
   numpy,
   requests,
@@ -41,6 +42,8 @@ buildPythonPackage rec {
       --replace-fail "poetry.masonry.api" "poetry.core.masonry.api"
   '';
 
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
   nativeCheckInputs = [
     pytestCheckHook
     mock

pkgs/development/python-modules/quantulum3/default.nix

@@ -28,6 +28,11 @@ buildPythonPackage {
     hash = "sha256-gE5JNUkIa+x/ottgXEf1WlieUG9mEcKjl3GSC2fWATY=";
   };
 
+  postPatch = ''
+    substituteInPlace quantulum3/__init__.py \
+      --replace-fail 'VERSION = (0, 9, 0)' 'VERSION = (0, 10, 0)'
+  '';
+
   dependencies = [
     inflect
     num2words

pkgs/development/python-modules/sharp-aquos-rc/default.nix

@@ -20,6 +20,12 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "version = '0.3.3'" "version = '${version}'" \
+      --replace-fail "tarball/0.3.3" "tarball/${version}"
+  '';
+
   propagatedBuildInputs = [ pyyaml ];
 
   # No tests

pkgs/development/python-modules/stups-pierone/default.nix

@@ -8,6 +8,7 @@
   stups-zign,
   pytestCheckHook,
   hypothesis,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -22,6 +23,11 @@ buildPythonPackage rec {
     hash = "sha256-OypGYHfiFUfcUndylM2N2WfPnfXXJ4gvWypUbltYAYE=";
   };
 
+  postPatch = ''
+    substituteInPlace pierone/__init__.py \
+      --replace-fail "__version__ = '0.22'" "__version__ = '${version}'"
+  '';
+
   build-system = [ setuptools ];
 
   pythonRelaxDeps = [ "stups-zign" ];
@@ -32,13 +38,10 @@ buildPythonPackage rec {
     stups-zign
   ];
 
-  preCheck = ''
-    export HOME=$TEMPDIR
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
     hypothesis
+    writableTmpDirAsHomeHook
   ];
 
   pythonImportsCheck = [ "pierone" ];

pkgs/development/python-modules/stups-zign/default.nix

@@ -7,6 +7,7 @@
   stups-tokens,
   stups-cli-support,
   pytestCheckHook,
+  writableTmpDirAsHomeHook,
   isPy3k,
 }:
 
@@ -31,6 +32,11 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace zign/__init__.py \
+      --replace-fail "__version__ = '2016.0.dev1'" "__version__ = '${version}'"
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -38,11 +44,10 @@ buildPythonPackage rec {
     stups-cli-support
   ];
 
-  preCheck = "
-    export HOME=$TEMPDIR
-  ";
-
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
 
   meta = {
     description = "OAuth2 token management command line utility";

pkgs/top-level/all-packages.nix

@@ -9289,9 +9289,9 @@ with pkgs;
 
   ddnet-server = ddnet.override { buildClient = false; };
 
-  dwarf-fortress-packages = recurseIntoAttrs (callPackage ../games/dwarf-fortress { });
+  dwarf-fortress-packages = recurseIntoAttrs (callPackage ../by-name/dw/dwarf-fortress { });
 
-  inherit (dwarf-fortress-packages) dwarf-fortress dwarf-fortress-full dwarf-therapist;
+  inherit (dwarf-fortress-packages) dwarf-fortress-full dwarf-therapist;
 
   dfhack = dwarf-fortress-packages.dwarf-fortress-full;