Merge 225a465eed into haskell-updates

This is similar to the patch for yesod, and for the same reason. This will
become unnecessary once cachix and hnix-store-core are updated upstream.

doc/languages-frameworks/ocaml.section.md

@@ -31,7 +31,7 @@ pkgs.mkShell {
 
 ## Packaging guide {#sec-language-ocaml-packaging}
 
-OCaml libraries are installed in `$out/lib/ocaml/${ocaml.version}/site-lib/`, or in the same directory of the `dev` output (see `buildDunePackage` below). Such directories are automatically added to the `$OCAMLPATH` environment variable when building another package that depends on them or when opening a `nix-shell`.
+OCaml libraries should be installed in `$(out)/lib/ocaml/${ocaml.version}/site-lib/`. Such directories are automatically added to the `$OCAMLPATH` environment variable when building another package that depends on them or when opening a `nix-shell`.
 
 Given that most of the OCaml ecosystem is now built with dune, nixpkgs includes a convenience build support function called `buildDunePackage` that will build an OCaml package using dune, OCaml and findlib and any additional dependencies provided as `buildInputs` or `propagatedBuildInputs`.
 
@@ -139,29 +139,6 @@ buildDunePackage (finalAttrs: {
 })
 ```
 
-Unless the package sets `outputs`, `buildDunePackage` builds separate outputs,
-and points `$OCAMLFIND_DESTDIR` to `dev`:
-
-- `out` contains what the package produces for use at runtime, such as
-  executables.
-- `dev` contains the OCaml libraries and the propagated dependencies needed to
-  build other packages against them. It is selected automatically when the
-  package is used as a build input.
-- `man` contains the man pages. Like `out`, it is installed by default.
-- `doc` contains the documentation, such as the README and license files.
-
-This keeps build-time only OCaml dependencies out of the runtime closure of
-executables. Code that refers to the library directory of such a package must
-use its `dev` output, for example `${lib.getDev menhirLib}/lib/ocaml` or
-`lib.makeSearchPathOutput "dev" "lib/ocaml/${ocaml.version}/site-lib"`.
-Likewise, installing the library into a profile or environment requires its
-`dev` output, e.g. `ocamlPackages.menhirLib.dev`.
-
-Toplevels and programs that load plugins need their own OCaml library at
-runtime, and the two outputs would refer to each other. Set
-`outputs = [ "out" ];` for such packages, and for packages whose custom
-`installPhase` installs everything into `$out`.
-
 The build will automatically fail if two distinct versions of the same library
 are added to `buildInputs` (which usually happens transitively because of
 `propagatedBuildInputs`). Set `dontDetectOcamlConflicts` to true to disable this

doc/languages-frameworks/swift.section.md

@@ -246,46 +246,6 @@ To disable the SwiftPM install phase, include the following in your derivation:
 { dontUseSwiftpmInstall = true; }
 ```
 
-## Swift Macros {#ssec-swift-macros}
-
-Nixpkgs includes the stdlib macros (ObservationMacros and SwiftMacros) and FoundationMacros in the toolchain.
-Packages that need macros for Apple frameworks on Darwin have two options:
-- `open-apple-macros` provides open-source implementations of FoundationModelsMacros and SwiftUIMacros; or
-- `darwin.xcode-macros` provides macro libraries from Xcode not otherwise included in the toolchain, but they are unfree.
-
-Add the appropriate package to `depsBuildBuild` (because they are compiler plugins that run on the build platform).
-If you need to manually specify the path for a package because it or its build system invokes `swiftc` directly:
-
-### `open-apple-macros` {#ssec-swift-macros-open-apple-macros}
-```nix
-{
-  buildPhase = ''
-    runHook preBuild
-    swiftc \
-      -external-plugin-path ${open-apple-macros}/lib/swift/host/plugins#${open-apple-macros}/libexec/swift/plugins/OpenAppleMacrosServer \
-      -disable-sandbox \
-      *.swift \
-      -o the_binary
-    runHook postBuild
-  '';
-}
-```
-
-### `darwin.xcode-macros` {#ssec-swift-macros-xcode-macros}
-```nix
-{
-  # For `darwin.xcode-macros`
-  buildPhase = ''
-    runHook preBuild
-    swiftc \
-      -plugin-path ${darwin.xcode-macros}/lib/swift/host/plugins \
-      *.swift \
-      -o the_binary
-    runHook postBuild
-  '';
-}
-```
-
 ## Hooks {#ssec-swift-hooks}
 
 Swift provides the following hooks to automate builds and unpack dependencies:

doc/redirects.json

@@ -4636,15 +4636,6 @@
   "ssec-swiftpm-install-phase": [
     "index.html#ssec-swiftpm-install-phase"
   ],
-  "ssec-swift-macros": [
-    "index.html#ssec-swift-macros"
-  ],
-  "ssec-swift-macros-open-apple-macros": [
-    "index.html#ssec-swift-macros-open-apple-macros"
-  ],
-  "ssec-swift-macros-xcode-macros": [
-    "index.html#ssec-swift-macros-xcode-macros"
-  ],
   "ssec-swift-hooks": [
     "index.html#ssec-swift-hooks"
   ],

doc/release-notes/rl-2611.section.md

@@ -52,13 +52,6 @@
 
 - `moon` has been updated to `2.x` and needs manual migration. See the [migration guide](https://moonrepo.dev/docs/migrate/2.0) for instructions.
 
-- `paperless-manage` now uses `runuser` instead of automatically calling `sudo` to set user/group before running. Invoke the script with `sudo paperless-manage` or an equivalent elevation tool of your choice
-
-- OpenSSL now prefers the system CA bundle at `/etc/ssl/certs/ca-certificates.crt` on both Linux and Darwin, falling back to `/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt` only when the system bundle is absent.
-  Previously, Darwin used the default Nix profile bundle directly.
-  An existing but unreadable or invalid system bundle does not trigger the fallback.
-  Explicit `NIX_SSL_CERT_FILE` and `SSL_CERT_FILE` overrides still take precedence.
-
 - `hyperfine` has been updated from 1.21.0 to 2.0.0, which contains several breaking changes:
   - Benchmarked commands are now executed directly instead of through an intermediate shell. Pass `-S`/`--shell=default` to restore the previous behavior.
   - The `--export-json` format has changed (schema version 2); tools consuming the exported JSON must be updated.
@@ -101,13 +94,6 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
-- `ocamlPackages.buildDunePackage` now builds packages with `out`, `dev`, `man` and `doc` outputs by default, unless they set `outputs`.
-  The OCaml libraries are installed into `dev`, man pages into `man`, documentation into `doc`, and `out` only contains what is needed at runtime, such as executables. This removes build-time only OCaml dependencies from the closure of tools like `patdiff`.
-  Code that refers to `${ocamlPackages.foo}/lib/ocaml` must use `${lib.getDev ocamlPackages.foo}/lib/ocaml` instead.
-  Installing such a library into a profile or environment (for example with `home.packages`, `environment.systemPackages` or `nix profile add`) no longer provides its `lib/ocaml` directory; install `ocamlPackages.foo.dev` instead.
-
-- The `bin` and `lib` outputs of `ocamlPackages.odoc`, `ocamlPackages.crunch`, `ocamlPackages.mdx` and `ocamlPackages.tw` were removed. Use the package itself for the executables, and its `dev` output for the OCaml library.
-
 - `bundlerApp` now sets `__structuredAttrs = true` for its result package.
   Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
 
@@ -206,10 +192,6 @@
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
-- `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now warn in the presence of `unittestFlagsArray`.
-  Please use [`unittestFlags`](#using-unittestcheckhook) instead.
-  If modifying the Nix expression is not feasible, users can remediate the warning by overriding `unittestFlagsArray` with `null` or `[ ]`.
-
 - `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
@@ -269,8 +251,6 @@
 
 - `tcl.mkTclDerivation` now enables `strictDeps` and `__structuredAttrs`.
 
-- `rustPlatform.cargoSetupHook` now forces several common C libraries to be linked to the Nixpkgs library rather than the vendored library. These include: aws-lc, openssl, libz, libsqlite3, zstd, libgit2, sodium, rustonig, libssh2, nginx, duckdb, and jemalloc. Set `dontCargoUseSystemLibs = true;` to opt out.
-
 - `rssguard` 5.x uses a new database layer. Regenerate your database after upgrading, following the [RSS Guard migration notes](https://rssguard.readthedocs.io/en/stable/contrib/migrate.html).
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
@@ -481,7 +461,7 @@
 
 - Firefox wrapper now accepts an optional `appDataDir` argument, which sets `MOZ_APP_DATA` to relocate Firefox application data. This is especially useful on macOS 27 and later, where wrapped Firefox applications may be denied access to profiles in traditional application data directory.
 
-- Swift has been upgraded to Swift 6.4.0 from Swift 5.10.1.
+- Swift has been upgraded to Swift 6.3.3 from Swift 5.10.1.
   The Swift packaging has been rewritten.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}

doc/stdenv/stdenv.chapter.md

@@ -1198,9 +1198,6 @@ They cannot be overridden without rebuilding the package.
 
 If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.
 
-`makeBinaryWrapper` refuses a `--prefix` or `--suffix` value that would introduce an empty segment (an empty value, or a leading, trailing or doubled separator), because many `PATH`-like variables interpret an empty segment as the current directory.
-For variables where an empty segment is useful and safe, such as `LUA_PATH` where `;;` stands for the default search path, use `--prefix-unchecked` or `--suffix-unchecked` instead.
-
 There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
 
 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.

maintainers/maintainer-list.nix

@@ -3468,6 +3468,12 @@
     githubId = 157330;
     name = "Ben Burdette";
   };
+  bcarrell = {
+    email = "brandoncarrell@gmail.com";
+    github = "bcarrell";
+    githubId = 1015044;
+    name = "Brandon Carrell";
+  };
   bcc32 = {
     email = "me@bcc32.com";
     github = "bcc32";
@@ -6780,7 +6786,7 @@
     name = "Dawid Sowa";
   };
   dawoox = {
-    email = "me@dawoox.dev";
+    email = "contact@antoinebellanger.fr";
     github = "Dawoox";
     githubId = 48325941;
     name = "Dawoox";
@@ -8061,6 +8067,12 @@
     githubId = 399312;
     name = "Vladyslav M.";
   };
+  dzabraev = {
+    email = "dzabraew@gmail.com";
+    github = "dzabraev";
+    githubId = 15128988;
+    name = "Maksim Dzabraev";
+  };
   dzervas = {
     name = "Dimitris Zervas";
     email = "dzervas@dzervas.gr";
@@ -10055,6 +10067,12 @@
     github = "ftsimas";
     githubId = 47324723;
   };
+  fuerbringer = {
+    email = "severin@fuerbringer.info";
+    github = "fuerbringer";
+    githubId = 10528737;
+    name = "Severin Fürbringer";
+  };
   fufexan = {
     email = "fufexan@protonmail.com";
     github = "fufexan";
@@ -13447,6 +13465,12 @@
     name = "Jere Vuola";
     keys = [ { fingerprint = "56C2 5B5B 2075 6352 B4B0  E17E F188 3717 47DA 5895"; } ];
   };
+  jeschli = {
+    email = "jeschli@gmail.com";
+    github = "0mbi";
+    githubId = 10786794;
+    name = "Markus Hihn";
+  };
   jess = {
     name = "Jessica";
     email = "jess+nix@jessie.cafe";
@@ -18720,6 +18744,12 @@
     githubId = 14008591;
     name = "Mack Binns";
   };
+  mbode = {
+    email = "maxbode@gmail.com";
+    github = "mbode";
+    githubId = 9051309;
+    name = "Maximilian Bode";
+  };
   mBornand = {
     email = "dev.mbornand@systemb.ch";
     github = "mBornand";
@@ -19832,11 +19862,11 @@
     githubId = 46468162;
   };
   moni = {
-    email = "nix@4rsxyzt.fyi";
+    email = "lythe1107@gmail.com";
     matrix = "@fortuneteller2k:matrix.org";
     github = "moni-dz";
     githubId = 20619776;
-    name = "Lythe Marvin L. Lacre";
+    name = "moni";
   };
   monkieeboi = {
     name = "MonkieeBoi";
@@ -22440,6 +22470,12 @@
     github = "ottoblep";
     githubId = 57066925;
   };
+  otwieracz = {
+    email = "slawek@otwiera.cz";
+    github = "otwieracz";
+    githubId = 108072;
+    name = "Slawomir Gonet";
+  };
   oughie = {
     name = "Oughie";
     email = "oughery@gmail.com";
@@ -24673,6 +24709,12 @@
     githubId = 7775707;
     name = "RB";
   };
+  rbasso = {
+    email = "rbasso@sharpgeeks.net";
+    github = "rbasso";
+    githubId = 16487165;
+    name = "Rafael Basso";
+  };
   rbreslow = {
     name = "Rocky Breslow";
     github = "rbreslow";
@@ -24837,6 +24879,12 @@
       { fingerprint = "66A8 1706 2227 9BD9 586A  CEDD 5B29 A881 3F47 65C4"; }
     ];
   };
+  relrod = {
+    email = "ricky@elrod.me";
+    github = "relrod";
+    githubId = 43930;
+    name = "Ricky Elrod";
+  };
   rembo10 = {
     github = "rembo10";
     githubId = 801525;
@@ -25622,6 +25670,12 @@
     githubId = 1728853;
     name = "Adam Washington";
   };
+  rps = {
+    email = "robbpseaton@gmail.com";
+    github = "robertseaton";
+    githubId = 221121;
+    name = "Robert P. Seaton";
+  };
   rraval = {
     email = "ronuk.raval@gmail.com";
     github = "rraval";
@@ -27352,11 +27406,6 @@
     github = "sinavir";
     githubId = 36380103;
   };
-  sinelaw = {
-    name = "Noam Lewis";
-    github = "sinelaw";
-    githubId = 84020;
-  };
   sinics = {
     name = "Zhifan";
     email = "nonno.felice69uwu@gmail.com";
@@ -27563,6 +27612,12 @@
     github = "sledgehammervampire";
     githubId = 47207223;
   };
+  sleexyz = {
+    email = "freshdried@gmail.com";
+    github = "sleexyz";
+    githubId = 1505617;
+    name = "Sean Lee";
+  };
   sleroq = {
     name = "Sleroq";
     email = "sleroq@cum.army";
@@ -28231,6 +28286,12 @@
     github = "stephsi";
     githubId = 3120909;
   };
+  sterfield = {
+    email = "sterfield@gmail.com";
+    github = "sterfield";
+    githubId = 5747061;
+    name = "Guillaume Loetscher";
+  };
   sternenseemann = {
     email = "sternenseemann@systemli.org";
     github = "sternenseemann";
@@ -29416,6 +29477,12 @@
     github = "TheOnlyMrCat";
     githubId = 23222857;
   };
+  theoparis = {
+    email = "theo@tinted.dev";
+    github = "theoparis";
+    githubId = 11761863;
+    name = "Theo Paris";
+  };
   therealansh = {
     email = "tyagiansh23@gmail.com";
     github = "therealansh";
@@ -30177,6 +30244,12 @@
     githubId = 144389458;
     name = "sapii";
   };
+  treemo = {
+    email = "matthieu.chevrier@treemo.fr";
+    github = "treemo";
+    githubId = 207457;
+    name = "Matthieu Chevrier";
+  };
   trespaul = {
     email = "paul@trespaul.com";
     github = "trespaul";
@@ -31168,6 +31241,12 @@
     githubId = 849772;
     name = "Venkateswara Rao Mandela";
   };
+  vmchale = {
+    email = "tmchale@wisc.edu";
+    github = "vmchale";
+    githubId = 13259982;
+    name = "Vanessa McHale";
+  };
   vmfunc = {
     github = "vmfunc";
     githubId = 59031302;

maintainers/scripts/haskell/eval-pkg-sets.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+#!nix-shell -p jq git
+# shellcheck shell=bash
+#
+# Usage: eval-pkg-sets.sh [extra flags for nix-* commands ...]
+#
+# Must be executed in a git checkout of Nixpkgs.
+
+set -euo pipefail
+
+NIXPKGS="$(git rev-parse --show-toplevel)"
+PKGSETS="$(nix-env --readonly-mode --json --drv-path -f "$NIXPKGS" -qaP -A haskell.compiler "$@" \
+  | jq -r 'to_entries | unique_by(.value.drvPath) .[] .key | sub("^haskell.compiler";"haskell.packages")')"
+
+trap 'exit 1' SIGINT SIGTERM
+
+set +e
+
+badsets=""
+for set in $PKGSETS; do
+  # Confirm an equivalent package set to haskell.compiler.$entry exists and is usable
+  if ! nix-instantiate --readonly-mode -A "$set.ghc" "$@" > /dev/null 2>&1; then
+    echo "Skipping $set... ($set.ghc does not evaluate)"
+  else
+    echo "Evaluating $set..."
+
+    if ! nix-env --readonly-mode -f "$NIXPKGS" -qaP --drv-path -A "$set" "$@" > /dev/null; then
+      badsets+="$set "
+    fi
+  fi
+done
+
+if [ -n "$badsets" ]; then
+  echo "Found potential eval issues in the following sets:" >&2
+  # shellcheck disable=SC2086
+  printf '%s\n' $badsets
+  exit 1
+fi

maintainers/scripts/haskell/unbreak.nu

@@ -6,7 +6,7 @@
 
 # Attention: For unknown reasons, the script can't be easily cancelled and needs to be killed manually if it shouldn't run to completion.
 
-use std log
+use std/log
 
 let broken_config = "pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml"
 

maintainers/scripts/haskell/update-stackage.sh

@@ -33,7 +33,7 @@ fi
 
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
-SOLVER=LTS
+SOLVER=Nightly
 # Stackage solver version, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
@@ -105,6 +105,7 @@ sed -r \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
     -e '/ spacecookie /d' \
+    -e '/ hnix-store-core /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -18,8 +18,6 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- GNOME has been updated to version 51. Refer to the [GNOME release notes](https://release.gnome.org/51/) for more details.
-
 - `sing-box` now supports NaïveProxy outbounds.
 
 ## New Modules {#sec-release-26.11-new-modules}
@@ -298,9 +296,6 @@
   Deployments running the server and worker in the same network namespace must also set at least the worker
   `AUTHENTIK_LISTEN__HTTP` address so that the server and worker do not bind to the same address.
 
-- `nfs-ganesha` has been updated to 15.9.
-  Support for the 9P file system has been removed in 15.9.
-
 - `podman` has been updated to Podman 6.
   - BoltDB support was dropped. Podman has been automatically migrating to SQLite since 5.8.0 on system reboots.
   - `iptables` support was dropped, Podman now unconditionally uses its `nftables` backend.

nixos/lib/make-system-tarball.sh

@@ -41,8 +41,7 @@ mkdir -p $out/tarball
 
 rm env-vars
 
-# Store optimization can change hardlink topology without changing input NARs.
-time tar --hard-dereference --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner -c * $extraArgs | $compressCommand > $out/tarball/$fileName.tar${extension}
+time tar --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner -c * $extraArgs | $compressCommand > $out/tarball/$fileName.tar${extension}
 
 mkdir -p $out/nix-support
 echo $system > $out/nix-support/system

nixos/modules/services/desktop-managers/gnome.nix

@@ -461,38 +461,35 @@ in
             pkgs.gtk3.out # for gtk-launch program
             pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
             pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks
-            pkgs.gnome-extensions-app
-            pkgs.gnome-tecla
           ];
         in
         mandatoryPackages ++ removeExcluded optionalPackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-51/elements/core/meta-gnome-core-apps.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
     (lib.mkIf serviceCfg.core-apps.enable {
       environment.systemPackages = removeExcluded [
         pkgs.baobab
         pkgs.decibels
         pkgs.epiphany
+        pkgs.gnome-text-editor
         pkgs.gnome-calculator
         pkgs.gnome-calendar
         pkgs.gnome-characters
         pkgs.gnome-clocks
-        pkgs.gnome-connections
         pkgs.gnome-console
         pkgs.gnome-contacts
-        # gnome-disk-utility is controlled below via `programs.gnome-disks`
         pkgs.gnome-font-viewer
         pkgs.gnome-logs
         pkgs.gnome-maps
         pkgs.gnome-music
-        # gnome-software is controlled below via `services.gnome.gnome-software`
         pkgs.gnome-system-monitor
-        pkgs.gnome-text-editor
+        pkgs.gnome-tecla
         pkgs.gnome-weather
         pkgs.loupe
         pkgs.nautilus
         pkgs.papers
+        pkgs.gnome-connections
         pkgs.showtime
         pkgs.simple-scan
         pkgs.snapshot
@@ -529,7 +526,6 @@ in
       ];
     })
 
-    # Note: This is an arbitrary list of packages, there is no "official" list of GNOME games.
     (lib.mkIf serviceCfg.games.enable {
       environment.systemPackages = removeExcluded [
         pkgs.aisleriot
@@ -555,13 +551,18 @@ in
       ];
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-51/elements/core/meta-gnome-core-developer-tools.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-developer-tools.bst
     (lib.mkIf serviceCfg.core-developer-tools.enable {
       environment.systemPackages = removeExcluded [
         pkgs.dconf-editor
         pkgs.devhelp
         pkgs.d-spy
         pkgs.gnome-builder
+        # boxes would make sense in this option, however
+        # it doesn't function well enough to be included
+        # in default configurations.
+        # https://github.com/NixOS/nixpkgs/issues/60908
+        # pkgs.gnome-boxes
         pkgs.sysprof
       ];
 

nixos/modules/services/display-managers/gdm.nix

@@ -353,26 +353,8 @@ in
           };
         }
       ]
-      ++ lib.optionals (!config.security.pam.p11.enable) [
-        {
-          settings."org/gnome/login-screen" = {
-            enable-smartcard-authentication = false;
-          };
-        }
-      ]
       ++ [ "${gdm}/share/gdm/greeter-dconf-defaults" ];
 
-    programs.dconf.profiles.user.databases = [
-      {
-        settings."org/gnome/login-screen" = {
-          enable-smartcard-authentication = config.security.pam.p11.enable;
-
-          # We currently don't provide a `gdm-switchable-auth` PAM service.
-          enable-switchable-authentication = false;
-        };
-      }
-    ];
-
     # Use AutomaticLogin if delay is zero, because it's immediate.
     # Otherwise with TimedLogin with zero seconds the prompt is still
     # presented and there's a little delay.
@@ -689,85 +671,6 @@ in
           ];
         };
       };
-
-      # Do not attempt to authenticate via smartcard when the login option
-      # "Password" is selected (gdm-password).
-      login.p11Auth = lib.mkIf config.security.pam.p11.enable false;
-
-      gdm-smartcard = lib.mkIf config.security.pam.p11.enable {
-        useDefaultRules = false;
-        rules = {
-          auth = utils.pam.autoOrderRules [
-            {
-              name = "nologin";
-              control = "requisite";
-              modulePath = "${config.security.pam.package}/lib/security/pam_nologin.so";
-            }
-            {
-              name = "faillock";
-              control = "requisite";
-              modulePath = "${config.security.pam.package}/lib/security/pam_faillock.so";
-              settings.preauth = true;
-            }
-            {
-              name = "p11";
-              control = "required";
-              modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so";
-              args = [
-                "${pkgs.opensc}/lib/opensc-pkcs11.so"
-              ];
-            }
-            {
-              name = "shells";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_shells.so";
-            }
-            {
-              name = "env";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
-              settings.conffile = "/etc/pam/environment";
-              settings.readenv = 0;
-            }
-            {
-              name = "gdm";
-              enable = pamLogin.enable && pamLogin.enableGnomeKeyring;
-              control = "[success=ok default=1]";
-              modulePath = "${gdm}/lib/security/pam_gdm.so";
-            }
-            {
-              name = "gnome_keyring";
-              enable = pamLogin.enable && pamLogin.enableGnomeKeyring;
-              control = "optional";
-              modulePath = "${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so";
-            }
-          ];
-
-          account = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-
-          password = utils.pam.autoOrderRules [
-            {
-              name = "deny";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_deny.so";
-            }
-          ];
-
-          session = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-        };
-      };
     };
 
   };

nixos/modules/services/games/archisteamfarm.nix

@@ -257,40 +257,52 @@ in
           }
         ];
 
-        preStart = ''
-          mkdir -p config
+        preStart =
+          let
+            createBotsScript =
+              pkgs.runCommand "ASF-bots"
+                {
+                  preferLocalBuild = true;
+                }
+                ''
+                  mkdir -p $out
+                  # clean potential removed bots
+                  rm -rf $out/*.json
+                  for i in ${
+                    lib.concatStringsSep " " (map (x: "${lib.getName x},${x}") (lib.mapAttrsToList mkBot cfg.bots))
+                  }; do IFS=",";
+                    set -- $i
+                    ln -fs $2 $out/$1
+                  done
+                '';
+            replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
+          in
+          ''
+            mkdir -p config
 
-          cp --no-preserve=mode '${configFile}' config/ASF.json
+            cp --no-preserve=mode ${configFile} config/ASF.json
 
-          ${lib.optionalString (cfg.licenseFile != null) ''
-            ${lib.getExe pkgs.replace-secret} '#licenseID#' '${cfg.licenseFile}' config/ASF.json
-          ''}
+            ${lib.optionalString (cfg.licenseFile != null) ''
+              ${replaceSecretBin} '#licenseID#' '${cfg.licenseFile}' config/ASF.json
+            ''}
 
-          ${lib.optionalString (cfg.ipcPasswordFile != null) ''
-            ${lib.getExe pkgs.replace-secret} '#ipcPassword#' '${cfg.ipcPasswordFile}' config/ASF.json
-          ''}
+            ${lib.optionalString (cfg.ipcPasswordFile != null) ''
+              ${replaceSecretBin} '#ipcPassword#' '${cfg.ipcPasswordFile}' config/ASF.json
+            ''}
 
-          ${lib.optionalString (cfg.ipcSettings != { }) ''
-            ln -fs ${ipc-config} config/IPC.config
-          ''}
+            ${lib.optionalString (cfg.ipcSettings != { }) ''
+              ln -fs ${ipc-config} config/IPC.config
+            ''}
 
-          for f in config/*.nixbot; do
-            [[ -f "$f" ]] || continue
-            rm "$f"
-            [[ -f "''${f%.nixbot}" ]] || continue
-            rm "''${f%.nixbot}"
-          done
+            ${lib.optionalString (cfg.bots != { }) ''
+              ln -fs ${createBotsScript}/* config/
+            ''}
 
-          ${lib.concatMapStrings (x: ''
-            cp --no-preserve=mode '${x}' 'config/${lib.getName x}'
-            touch 'config/${lib.getName x}.nixbot'
-          '') (lib.mapAttrsToList mkBot cfg.bots)}
-
-          rm -f www
-          ${lib.optionalString cfg.web-ui.enable ''
-            ln -s '${cfg.web-ui.package}/' www
-          ''}
-        '';
+            rm -f www
+            ${lib.optionalString cfg.web-ui.enable ''
+              ln -s ${cfg.web-ui.package}/ www
+            ''}
+          '';
       };
     };
   };

nixos/modules/services/misc/paperless.nix

@@ -9,7 +9,7 @@ let
   cfg = config.services.paperless;
   opt = options.services.paperless;
   pythonPkgs = cfg.package.python.pkgs;
-  defaultUsername = "paperless";
+  defaultUser = "paperless";
   defaultFont = "${pkgs.liberation_ttf}/share/fonts/truetype/LiberationSerif-Regular.ttf";
 
   # Don't start a redis instance if the user sets a custom redis connection
@@ -58,39 +58,26 @@ let
       toString s
   ) cfg.settings);
 
-  loadEnv = pkgs.writeShellScriptBin "paperless-manage-load-env" ''
+  manage = pkgs.writeShellScriptBin "paperless-manage" ''
     set -o allexport # Export the following env vars
     ${lib.toShellVars env}
     ${lib.optionalString (cfg.environmentFile != null) "source ${cfg.environmentFile}"}
     if [[ -z "''${PAPERLESS_SECRET_KEY:-}" && -e '${secretKeyFile}' ]]; then
       source '${secretKeyFile}'
     fi
-    set +o allexport
+
     cd '${cfg.dataDir}'
-    ${lib.getExe cfg.package} "$@"
+    sudo=exec
+    if [[ "$USER" != ${cfg.user} ]]; then
+      ${
+        if config.security.sudo.enable then
+          "sudo='exec ${config.security.wrapperDir}/sudo -u ${cfg.user} -E'"
+        else
+          ">&2 echo 'Aborting, paperless-manage must be run as user `${cfg.user}`!'; exit 2"
+      }
+    fi
+    $sudo ${lib.getExe cfg.package} "$@"
   '';
-  paperlessManageScript = (
-    pkgs.writeShellScriptBin "paperless-manage" ''
-      # Switch user and run script
-      case "$(whoami)" in
-        "root")
-          ${lib.getExe' pkgs.util-linux "runuser"} ${
-            lib.cli.toCommandLineShellGNU { } {
-              preserve-environment = true;
-              user = cfg.user;
-              group = cfg.group;
-              supp-group = if enableRedis then redisServer.group else null;
-            }
-          } -- ${lib.getExe loadEnv} "$@";;
-        "${cfg.user}")
-          ${lib.getExe loadEnv} "$@"  ;;
-        *)
-          echo "Aborting, paperless-manage must be run as 'root' or user '${cfg.user}'!" >&2
-          echo "You may wish to rerun this with 'sudo'  " >&2
-          exit 2
-      esac
-    ''
-  );
 
   defaultServiceConfig = {
     Slice = "system-paperless.slice";
@@ -135,10 +122,6 @@ let
     RestrictNamespaces = true;
     RestrictRealtime = true;
     RestrictSUIDSGID = true;
-    User = cfg.user;
-    Group = cfg.group;
-    # Fallback for when `cfg.user != defaultUsername`
-    SupplementaryGroups = lib.optional enableRedis redisServer.group;
     SystemCallArchitectures = "native";
     SystemCallFilter = [
       "@system-service"
@@ -286,7 +269,7 @@ in
 
     user = lib.mkOption {
       type = lib.types.str;
-      default = defaultUsername;
+      default = defaultUser;
       description = ''
         User under which Paperless runs
 
@@ -300,7 +283,7 @@ in
 
     group = lib.mkOption {
       type = lib.types.str;
-      default = defaultUsername;
+      default = defaultUser;
       description = ''
         Primary group under which Paperless runs
 
@@ -485,8 +468,8 @@ in
           }
         ];
 
-        services.paperless.manage = paperlessManageScript;
-        environment.systemPackages = [ paperlessManageScript ];
+        services.paperless.manage = manage;
+        environment.systemPackages = [ manage ];
 
         services.nginx = lib.mkIf cfg.configureNginx {
           enable = true;
@@ -548,7 +531,8 @@ in
         systemd.tmpfiles.settings."10-paperless" =
           let
             defaultRule = {
-              inherit (cfg) user group;
+              inherit (cfg) user;
+              inherit (config.users.users.${cfg.user}) group;
             };
           in
           {
@@ -582,7 +566,7 @@ in
             Type = "oneshot";
             RemainAfterExit = true;
             User = cfg.user;
-            Group = cfg.group;
+            Group = config.users.users.${cfg.user}.group;
             UMask = "0077";
             Slice = "system-paperless.slice";
             EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
@@ -616,6 +600,7 @@ in
             "paperless-task-queue.service"
           ];
           serviceConfig = defaultServiceConfig // {
+            User = cfg.user;
             ExecStart = "${cfg.package}/bin/celery --app paperless beat --loglevel INFO";
             Restart = "on-failure";
             LoadCredential = lib.optionalString (
@@ -674,6 +659,7 @@ in
           ]
           ++ lib.optional cfg.database.createLocally "postgresql.target";
           serviceConfig = defaultServiceConfig // {
+            User = cfg.user;
             ExecStart = "${cfg.package}/bin/celery --app paperless worker --loglevel INFO";
             Restart = "on-failure";
             # The `mbind` syscall is needed for running the classifier.
@@ -695,6 +681,7 @@ in
           ]
           ++ lib.optional cfg.database.createLocally "postgresql.target";
           serviceConfig = defaultServiceConfig // {
+            User = cfg.user;
             ExecStart = "${lib.getExe cfg.package} document_consumer";
             Restart = "on-failure";
             PrivateNetwork = cfg.database.createLocally; # defaultServiceConfig enables this by default, needs to be disabled for remote DBs
@@ -716,7 +703,8 @@ in
           ]
           ++ lib.optional cfg.database.createLocally "postgresql.target";
           serviceConfig = defaultServiceConfig // {
-            ExecStart = "${lib.getExe cfg.package.python.pkgs.granian} --interface asginl --ws paperless.asgi:application";
+            User = cfg.user;
+            ExecStart = "${lib.getExe pythonPkgs.granian} --interface asginl --ws paperless.asgi:application";
             Restart = "on-failure";
 
             LimitNOFILE = 65536;
@@ -738,18 +726,16 @@ in
           unitConfig.JoinsNamespaceOf = "paperless-task-queue.service";
         };
 
-        users = lib.optionalAttrs (cfg.user == defaultUsername) {
-          users.${cfg.user} = {
-            extraGroups = lib.optional enableRedis redisServer.group;
-            group = cfg.group;
+        users = lib.optionalAttrs (cfg.user == defaultUser) {
+          users.${defaultUser} = {
+            extraGroups = [ config.services.redis.servers.paperless.group ];
+            group = defaultUser;
             home = cfg.dataDir;
             uid = config.ids.uids.paperless;
           };
 
-          groups = lib.optionalAttrs (cfg.group == defaultUsername) {
-            ${cfg.group} = {
-              gid = config.ids.gids.paperless;
-            };
+          groups.${defaultUser} = {
+            gid = config.ids.gids.paperless;
           };
         };
 
@@ -768,7 +754,7 @@ in
 
       (lib.mkIf cfg.exporter.enable {
         systemd.tmpfiles.rules = [
-          "d '${cfg.exporter.directory}' - ${cfg.user} ${cfg.group} - -"
+          "d '${cfg.exporter.directory}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
         ];
 
         services.paperless.exporter.settings = lib.mapAttrs (
@@ -779,7 +765,6 @@ in
           startAt = lib.defaultTo [ ] cfg.exporter.onCalendar;
           serviceConfig = {
             User = cfg.user;
-            Group = cfg.group;
             WorkingDirectory = cfg.dataDir;
           };
           unitConfig =
@@ -800,7 +785,7 @@ in
               OnSuccess = services;
             };
           enableStrictShellChecks = true;
-          path = [ paperlessManageScript ];
+          path = [ manage ];
           script = ''
             paperless-manage document_exporter ${cfg.exporter.directory} ${
               lib.cli.toCommandLineShellGNU { } cfg.exporter.settings

nixos/modules/services/misc/tabby.nix

@@ -98,7 +98,7 @@ in
 
           - nixpkgs.config.cudaSupport
           - nixpkgs.config.rocmSupport
-          - if stdenv.hostPlatform.isDarwin
+          - if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
 
           IFF multiple acceleration methods are found to be enabled or if you
           haven't set either `cudaSupport or rocmSupport` you will have to

nixos/tests/keepassxc.nix

@@ -43,7 +43,7 @@
   testScript =
     { nodes, ... }:
     let
-      aliceDo = cmd: ''machine.succeed("su - alice -c '${cmd}' >&2");'';
+      aliceDo = cmd: ''machine.succeed("su - alice -c '${cmd}' >&2 &");'';
     in
     ''
       with subtest("Ensure X starts"):
@@ -53,7 +53,6 @@
       with subtest("Can create database and entry with CLI"):
           ${aliceDo "keepassxc-cli db-create --set-key-file foo.keyfile foo.kdbx"}
           ${aliceDo "keepassxc-cli add --no-password -k foo.keyfile foo.kdbx bar"}
-          ${aliceDo "keepassxc-cli ls --no-password -k foo.keyfile foo.kdbx | grep bar"}
 
       with subtest("Ensure KeePassXC starts"):
           # start KeePassXC window

nixos/tests/librenms.nix

@@ -55,7 +55,7 @@ in
         ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS
         API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';")
 
-        ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO personal_access_tokens (tokenable_type, tokenable_id, name, token, abilities) VALUES (CONCAT('App', CHAR(92), 'Models', CHAR(92), 'User'), $API_USER_ID, 'API User', SHA2('$API_TOKEN', 256), '[\"*\"]')"
+        ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')"
       '';
     };
   };
@@ -96,6 +96,6 @@ in
     librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices")
 
     # wait until snmphost gets polled
-    librenms.wait_until_succeeds("curl -fsS -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -e '.devices[0].last_polled != null'")
+    librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'")
   '';
 }

nixos/tests/lomiri-gallery-app.nix

@@ -19,14 +19,6 @@ let
 
       let
         format = lib.lists.last (lib.strings.splitString "." file);
-        burgerMenuCategory = lib.lists.head (lib.strings.splitString "/" file);
-        burgerMenuYCoord =
-          {
-            "Pictures" = "180";
-            "Videos" = "220";
-          }
-          .${burgerMenuCategory}
-            or (throw "nixosTests.lomiri-gallery-app.format-${format}: don't know at what Y coordinate the '${burgerMenuCategory} category is");
       in
 
       {
@@ -107,8 +99,6 @@ let
         enableOCR = true;
 
         testScript = ''
-          import datetime
-
           machine.wait_for_x()
 
           machine.succeed("mkdir /root/${dirOf file}")
@@ -144,22 +134,22 @@ let
 
           with subtest("lomiri gallery finds files"):
               machine.succeed("lomiri-gallery-app >&2 &")
-              machine.wait_for_console_text("media files loaded")
-              machine.sleep(datetime.timedelta(seconds=10))
+              machine.wait_for_console_text("qq= AlbumsOverview") # logged when album page actually gets loaded
+              machine.sleep(10)
               machine.send_key("alt-f10")
-              machine.sleep(datetime.timedelta(seconds=5))
+              machine.sleep(5)
               machine.wait_for_text(r"(Albums|Events|Photos|${imageLabel})")
 
               machine.succeed("xdotool mousemove 30 40 click 1") # burger menu for categories
-              machine.sleep(datetime.timedelta(seconds=2))
-              machine.succeed("xdotool mousemove 30 ${burgerMenuYCoord} click 1") # category for file
-              machine.sleep(datetime.timedelta(seconds=2))
+              machine.sleep(2)
+              machine.succeed("xdotool mousemove 30 180 click 1") # photos
+              machine.sleep(2)
               machine.screenshot("lomiri-gallery_photos")
 
           machine.succeed("xdotool mousemove 80 140 click 1") # select first one
-          machine.sleep(datetime.timedelta(seconds=2))
+          machine.sleep(2)
           machine.succeed("xdotool mousemove 80 140 click 1") # enable top-bar
-          machine.sleep(datetime.timedelta(seconds=2))
+          machine.sleep(2)
 
         ''
         + (
@@ -171,10 +161,10 @@ let
                   machine.succeed("xdotool mousemove ${
                     if buttonIsOffset then "900" else "940"
                   } 50 click 1") # open media information
-                  machine.sleep(datetime.timedelta(seconds=2))
+                  machine.sleep(2)
                   machine.screenshot("lomiri-gallery_${format}_info")
                   machine.send_key("esc")
-                  machine.sleep(datetime.timedelta(seconds=2))
+                  machine.sleep(2)
                   machine.wait_for_text("${imageLabel}") # make sure media shows fine
             ''
         );
@@ -246,16 +236,14 @@ in
       enableOCR = true;
 
       testScript = ''
-        import datetime
-
         machine.wait_for_x()
 
         with subtest("lomiri gallery launches"):
             machine.succeed("lomiri-gallery-app >&2 &")
-            machine.wait_for_console_text("media files loaded")
-            machine.sleep(datetime.timedelta(seconds=10))
+            machine.wait_for_console_text("qq= AlbumsOverview") # logged when album page actually gets loaded
+            machine.sleep(10)
             machine.send_key("alt-f10")
-            machine.sleep(datetime.timedelta(seconds=5))
+            machine.sleep(5)
             machine.wait_for_text(r"(Albums|Events|Photos)")
             machine.screenshot("lomiri-gallery_open")
 
@@ -266,10 +254,10 @@ in
 
         with subtest("lomiri gallery localisation works"):
             machine.succeed("env LANG=de_DE.UTF-8 lomiri-gallery-app >&2 &")
-            machine.wait_for_console_text("media files loaded")
-            machine.sleep(datetime.timedelta(seconds=10))
+            machine.wait_for_console_text("qq= AlbumsOverview") # logged when album page actually gets loaded
+            machine.sleep(10)
             machine.send_key("alt-f10")
-            machine.sleep(datetime.timedelta(seconds=5))
+            machine.sleep(5)
             machine.wait_for_text(r"(Alben|Ereignisse|Fotos)")
             machine.screenshot("lomiri-gallery_localised")
       '';
@@ -284,17 +272,17 @@ in
     customTest = ''
       with subtest("lomiri gallery handles mp4"):
           machine.succeed("xdotool mousemove 935 40 click 1") # open media information
-          machine.sleep(datetime.timedelta(seconds=2))
+          machine.sleep(2)
           machine.screenshot("lomiri-gallery_mp4_info")
           machine.send_key("esc")
-          machine.sleep(datetime.timedelta(seconds=2))
+          machine.sleep(2)
 
           machine.wait_for_text("${imageLabel}") # make sure thumbnail processing worked
           machine.screenshot("lomiri-gallery_mp4_thumbnail")
 
           machine.succeed("xdotool mousemove 510 380 click 1") # dispatch to system's video handler
           machine.wait_until_succeeds("pgrep -u root -f mpv") # wait for video to start
-          machine.sleep(datetime.timedelta(seconds=10))
+          machine.sleep(10)
           machine.succeed("pgrep -u root -f mpv") # should still be playing
           machine.screenshot("lomiri-gallery_mp4_dispatch")
     '';

nixos/tests/terminal-emulators.nix

@@ -41,11 +41,6 @@ let
     ghostty.pkg = p: p.ghostty;
     ghostty.cmd = "ghostty -e $command";
 
-    gnome-console.pkg = p: p.gnome-console;
-    gnome-console.executable = "kgx";
-    gnome-console.cmd = "kgx -e $command";
-    gnome-console.kill = true;
-
     gnome-terminal.pkg = p: p.gnome-terminal;
 
     guake.pkg = p: p.guake;
@@ -56,6 +51,10 @@ let
 
     kermit.pkg = p: p.kermit-terminal;
 
+    kgx.pkg = p: p.kgx;
+    kgx.cmd = "kgx -e $command";
+    kgx.kill = true;
+
     kitty.pkg = p: p.kitty;
     kitty.cmd = "kitty $command";
 

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.1252";
+  version = "9.2.1164";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-k5Na69KYXb7kxajpJFv9+vBymApaio7TwHrETudAGrk=";
+    hash = "sha256-Ymtq7+egq8OydTdzHP/q14MK6p+crKlQwduJ27oDbNU=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vscode/extensions/pkief.material-icon-theme/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "material-icon-theme";
     publisher = "PKief";
-    version = "5.40.0";
-    hash = "sha256-VbVl8gCIGr/YB7r5vlL85F/VL+8BO6cbD4OUmEzhrgY=";
+    version = "5.39.0";
+    hash = "sha256-8/2k4dYJXZQskkZ8GtbzIqdMYhYPfSl0EFjk1yaSL70=";
   };
   meta = {
     description = "Material Design Icons for Visual Studio Code";

pkgs/applications/editors/vscode/extensions/quarto.quarto/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "quarto";
     publisher = "quarto";
-    version = "1.139.0";
-    hash = "sha256-+BqGXFEaHGdNAg1yezCwz0mTZf4JCO4e2+tXnxFs8is=";
+    version = "1.138.0";
+    hash = "sha256-xwqs28ihgYnk7lPLjGQGwnG7ig2HLT9ZyCg1jiHpmR8=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/quarto.quarto/changelog";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-caVs5o3eji314tCNqRw9Fac7ljlAPDibsIkWJPt91hU=",
+    "hash": "sha256-wH0SiHB+IxOM3hajrkZzF0T7aBDd8IiY6fGSgOkUhMA=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.65.1",
+    "rev": "v4.64.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-rpsVkSX4GvCSNuT8cea1IPce+NIUGZqkQmB3ZxhKjrM="
+    "vendorHash": "sha256-htYhRdpwqZIUaWV8weyvgAGJlFTxbpVjPHXWYOAprag="
   },
   "akamai_akamai": {
     "hash": "sha256-6nKfNzNsqp5x6/C5hr1UNC2gz5eTV2DonNQ3olvGxIA=",
@@ -616,13 +616,13 @@
     "vendorHash": "sha256-ZkQt1RTq+6R2U7blmkr8PIRHtGFE6MllcLVlcfPlFB4="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-7YW5NiP8+Q86+o1R2XtkZhpJJpsH5gQnPHXE6qbibA0=",
+    "hash": "sha256-GcW7F/xNValvQXtUhBxOPjfRa6891INVXNRxoSnnCy0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v8.9.0",
+    "rev": "v8.7.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-IBx6MOR8WLV205wbAAyhWLzWDuqGQkMM4htCeWqh9zs="
+    "vendorHash": "sha256-KI1hUXlJVoKGRyDODIfHJCBmN08Hml5JK+BSYiWGeXQ="
   },
   "hashicorp_helm": {
     "hash": "sha256-O3QcQf+TBmSB/mY5wybk/8BUG5RTjLhJYU+9jOOUqBI=",
@@ -887,13 +887,13 @@
     "vendorHash": "sha256-BFhxDYfbHNY4omovikg01UDqt2oxCtg9Q85DPuHSUeE="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-u8Qy8wnMv08/3ZKOiR7Lq3Nv54pjtPRBf2lbenuLXaA=",
+    "hash": "sha256-BUYjmfbWGzzIK3jJyt0VxuMpA+q7gIY+Mk3yFx4xeC4=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v3.3.0",
+    "rev": "v3.1.7",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-m/Yd5rPIFgkY/E3rXWbjcdocMjyex+NWulM/WiXEbIs="
+    "vendorHash": "sha256-d8RQfuLRNGTUzA2Ygy3QEis5j5Ape5kmcnZSs77c84M="
   },
   "linode_linode": {
     "hash": "sha256-jOcGJq3X7TCuXk9GDgHZAj9SAbq/msJdjpEukOz7bFY=",
@@ -1463,11 +1463,11 @@
     "vendorHash": null
   },
   "ubiquiti-community_unifi": {
-    "hash": "sha256-j7xlpU194z8f/W7SxcdhDdywWEO9y4TAdeSeQKw0JkM=",
+    "hash": "sha256-GQFSi57+oebB9OiySbDD6gu8YDqKWCkIx31yORJIpVk=",
     "homepage": "https://registry.terraform.io/providers/ubiquiti-community/unifi",
     "owner": "ubiquiti-community",
     "repo": "terraform-provider-unifi",
-    "rev": "v0.60.0",
+    "rev": "v0.59.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-XH3Z47i7WTiZ+WrUadoRABcXD8ZkeXnJHINKkAHseE8="
   },

pkgs/applications/science/logic/coq/with-packages.nix

@@ -24,9 +24,9 @@ let
 
   coqPath = lib.makeSearchPath "/lib/coq/${rocq-version}/user-contrib" allPackages;
 
-  ocamlPath =
-    lib.makeSearchPathOutput "dev" "/lib/ocaml/${coq.ocamlPackages.ocaml.version}/site-lib"
-      ([ coq.ocamlPackages.findlib ] ++ allPackages);
+  ocamlPath = lib.makeSearchPath "/lib/ocaml/${coq.ocamlPackages.ocaml.version}/site-lib" (
+    [ coq.ocamlPackages.findlib ] ++ allPackages
+  );
 
   pathEnvVar = if isRocq then "ROCQPATH" else "COQPATH";
 in

pkgs/applications/virtualization/docker/default.nix

@@ -64,6 +64,8 @@ let
       versionCheckHook,
     }:
     let
+      systemdLibs' = systemdLibs.override { withCompression = true; };
+
       docker-meta = {
         license = lib.licenses.asl20;
         maintainers = with lib.maintainers; [
@@ -190,7 +192,7 @@ let
           ++ lib.optionals (lib.versionAtLeast version "29.0.0") [ nftables ]
           ++ lib.optionals withLvm [ lvm2 ]
           ++ lib.optionals withBtrfs [ btrfs-progs ]
-          ++ lib.optionals withSystemd [ systemdLibs ]
+          ++ lib.optionals withSystemd [ systemdLibs' ]
           ++ lib.optionals withSeccomp [ libseccomp ];
 
           postPatch = ''

pkgs/build-support/bintools-wrapper/ld-wrapper.sh

@@ -200,30 +200,37 @@ if [[ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 && "$linkType" != static-pie ]]; t
     # so, add the directory to the rpath.
     # It's important to add the rpath in the order of -L..., so
     # the link time chosen objects will be those of runtime linking.
-    declare -A rpaths seenLibDirs
+    declare -A rpaths
     for dir in ${libDirs+"${libDirs[@]}"}; do
-        # The same directory is often passed many times, such as from
-        # NIX_LDFLAGS; it would give the same result each time.
-        if [ -n "${seenLibDirs[$dir]:-}" ]; then
+        # If the path is in the store, do not resolve any symlinks and add it to the rpath.
+        # Resolving symlinks in the store breaks bootstrapping, see issue #454199.
+        # If it is outside the store, resolve symlinks step by step until it falls
+        # into the store or it becomes not a symlink.
+        # Always canonicalize the path before checking it is in the store or not.
+        if dir2=$(realpath -s "$dir"); then
+            dir="$dir2"
+        else
             continue
         fi
-        seenLibDirs["$dir"]=1
-        # Find where the directory is, following symlinks outside the store,
-        # and in it only where needed; see resolveLibDir.  Skip directories
-        # that do not exist, in which the linker cannot find libraries either.
-        if ! [ -d "$dir" ] || ! resolveLibDir "$dir"; then
-            continue
-        fi
-        dir="$resolvedPath"
+        while [ -z "${rpaths[$dir]:-}" ] && [[ "$dir" != "${NIX_STORE:-}"/* ]] && [ -L "$dir" ]; do
+            if dir2=$(readlink "$dir"); then
+                dir="dir2"
+            else
+                break
+            fi
+            if dir2=$(realpath -s "$dir"); then
+                dir="dir2"
+            else
+                break
+            fi
+        done
         # If the path turns out to be outside the store, we do not add it to rpath.
         # This typically happens for libraries in /tmp that are later
         # copied to $out/lib. If not, we're screwed.
         if [ -n "${rpaths[$dir]:-}" ] || [[ "$dir" != "${NIX_STORE:-}"/* ]]; then
             continue
         fi
-        # Every name in libs is that of a shared library, ending in .so or
-        # containing .so., so the rest of the directory can be skipped.
-        for path in "$dir"/*.so*; do
+        for path in "$dir"/*; do
             file="${path##*/}"
             if [ "${libs[$file]:-}" ]; then
                 # This library may have been provided by a previous directory,

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -129,8 +129,6 @@ lib.makeOverridable (
               "pki"
               # Custom dconf profiles
               "dconf"
-              # EGL platform definitions (required by nvidia-x11)
-              "egl"
             ];
           in
           map (path: "/etc/${path}") files;

pkgs/build-support/go/module.nix

@@ -302,7 +302,7 @@ lib.extendMkDerivation {
 
                 if [ "$cmd" = "test" ]; then
                   flags+=(-vet=off)
-                  concatTo flags checkFlags
+                  flags+=($checkFlags)
                 fi
 
                 local OUT

pkgs/build-support/node/prefetch-npm-deps/default.nix

@@ -20,8 +20,6 @@
     pname = "prefetch-npm-deps";
     version = (lib.importTOML ./Cargo.toml).package.version;
 
-    __structuredAttrs = true;
-
     src = lib.cleanSourceWith {
       src = ./.;
       filter =

pkgs/build-support/ocaml/dune.nix

@@ -45,26 +45,6 @@ lib.extendMkDerivation {
 
         strictDeps = true;
 
-        # OCaml libraries, and the dependencies they propagate, are only needed
-        # to build other packages. Unless the package chooses its outputs,
-        # those are installed into "dev", rather than "out", to minimize the
-        # "out" runtime closure. Man pages and documentation go to "man" and
-        # "doc".
-        outputs =
-          args.outputs or [
-            "out"
-            "dev"
-            "man"
-            "doc"
-          ];
-
-        # The findlib setup hook always points OCAMLFIND_DESTDIR at $out, so
-        # override it after all setup hooks have run.
-        postHook = ''
-          export OCAMLFIND_DESTDIR="''${!outputDev}/lib/ocaml/${ocaml.version}/site-lib/"
-        ''
-        + args.postHook or "";
-
         inherit enableParallelBuilding;
         dontAddStaticConfigureFlags = true;
         configurePlatforms = [ ];
@@ -87,15 +67,12 @@ lib.extendMkDerivation {
           args.installPhase or ''
             runHook preInstall
             dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${lib.concatStringsSep " " dunePackages} \
-             ${lib.optionalString (lib.versionAtLeast Dune.version "2.9") ''
-               --docdir "''${!outputDoc}/share/doc" --mandir "''${!outputMan}/share/man" --etcdir "$out/etc" \
-             ''} ${lib.optionalString (lib.versionAtLeast Dune.version "3.0") ''
-               --bindir "''${!outputBin}/bin" --datadir "$out/share"
-             ''}
-            # Not every package installs something into each output.
-            for output in $(getAllOutputNames); do
-              mkdir -p "''${!output}"
-            done
+             ${
+               if lib.versionAtLeast Dune.version "2.9" then
+                 "--docdir $out/share/doc --mandir $out/share/man"
+               else
+                 ""
+             }
             runHook postInstall
           '';
 
@@ -106,22 +83,8 @@ lib.extendMkDerivation {
             runHook postCheck
           '';
 
-        # With several outputs, multiple-outputs.sh passes autoconf-style
-        # --bindir/--libdir/--mandir/... flags to ./configure. The configure
-        # scripts shipped by dune packages are hand-written and reject them.
-        setOutputFlags = args.setOutputFlags or false;
-
-        meta =
-          let
-            meta = args.meta or { };
-            # meta is often copied from another package, which may have other
-            # outputs. Keep the default if none of them are left.
-            outputsToInstall = lib.intersectLists finalAttrs.outputs (meta.outputsToInstall or [ ]);
-          in
-          removeAttrs meta [ "outputsToInstall" ]
-          // {
-            platforms = meta.platforms or ocaml.meta.platforms;
-          }
-          // lib.optionalAttrs (outputsToInstall != [ ]) { inherit outputsToInstall; };
+        meta = (args.meta or { }) // {
+          platforms = args.meta.platforms or ocaml.meta.platforms;
+        };
       };
 }

pkgs/build-support/rust/fetch-cargo-vendor-util.py

@@ -1,223 +1,57 @@
 import functools
 import hashlib
 import json
-import os
+import multiprocessing as mp
 import re
 import shutil
 import subprocess
 import sys
-import tempfile
-import threading
 import tomllib
-from concurrent.futures import FIRST_EXCEPTION, Future, ThreadPoolExecutor, wait
-from dataclasses import dataclass, field
 from os.path import islink, realpath
 from pathlib import Path
-from typing import Any, cast
+from typing import Any, TypedDict, cast
 from urllib.parse import unquote
 
+import requests
 import tomli_w
-from requests import Session
 from requests.adapters import HTTPAdapter, Retry
 
-# Constants for controlling how the crates are downloaded from the registries via `requests`
-# These do not affect the fetching of git dependencies
-MAX_WORKERS = min(5, os.cpu_count() or 1)  # number of workers in the ThreadPoolExecutor
-CONNECT_TIMEOUT = 2  # max seconds for establishing initial connection
-READ_TIMEOUT = 10  # max seconds between receiving data packets
-TIMEOUT = (CONNECT_TIMEOUT, READ_TIMEOUT)
-RETRY_COUNT = 3  # number of retries for fetching an url
-BACKOFF_FACTOR = 0.5  # seconds to wait between retries (gets multiplied by 2 after every retry)
-
-# If for some reason our custom User-Agent value starts getting rejected, we could
-# set the User-Agent to the value that cargo uses, e.g.: "cargo/1.95.0 (f2d3ce0bd 2026-03-21)"
-USER_AGENT = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
-
 eprint = functools.partial(print, file=sys.stderr)
 
 
-@dataclass
-class RegistrySource:
-    raw: str
-    url: str
-    is_sparse: bool
-    ind: int = field(init=False)
+def load_toml(path: Path) -> dict[str, Any]:
+    with open(path, "rb") as f:
+        return tomllib.load(f)
 
 
-@dataclass
-class RegistryPackage:
-    name: str
-    version: str
-    source: RegistrySource
-    checksum: str
+def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
+    # lockfile v1 and v2 don't have the `version` key, so assume v2
+    version = cargo_lock_toml.get("version", 2)
+
+    # TODO: add logic for differentiating between v1 and v2
+
+    return version
 
 
-GIT_SOURCE_REGEX = re.compile(r"git\+(?P<url>[^?]+)(\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
-
-
-@dataclass
-class GitSource:
-    raw: str
-    url: str
-    type: str | None
-    value: str | None
-    git_sha_rev: str
-    ind: int = field(init=False)
-
-
-@dataclass
-class GitPackage:
-    name: str
-    version: str
-    source: GitSource
-
-
-Source = RegistrySource | GitSource
-Package = RegistryPackage | GitPackage
-
-
-@dataclass
-class Lockfile:
-    version: int
-    sources: list[Source]
-    packages: list[Package]
-
-
-def parse_git_source(raw_source: str, lockfile_version: int) -> GitSource:
-    match = GIT_SOURCE_REGEX.match(raw_source)
-    if match is None:
-        raise Exception(f"Unable to process git source: {raw_source}.")
-
-    parsed_dict = match.groupdict(default=None)
-    url = cast(str, parsed_dict["url"])
-    git_sha_rev = cast(str, parsed_dict["git_sha_rev"])
-
-    source = GitSource(raw_source, url, parsed_dict["type"], parsed_dict["value"], git_sha_rev)
-
-    # the source URL is URL-encoded in lockfile_version >=4
-    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
-    if lockfile_version >= 4 and source.value is not None:
-        source.value = unquote(source.value)
-
-    return source
-
-
-def parse_source(raw_source: str, lockfile_version: int) -> Source:
-    if raw_source.startswith("git+"):
-        return parse_git_source(raw_source, lockfile_version)
-    elif raw_source.startswith("registry+"):
-        return RegistrySource(raw=raw_source, url=raw_source[9:], is_sparse=False)
-    elif raw_source.startswith("sparse+"):
-        return RegistrySource(raw=raw_source, url=raw_source[7:].rstrip("/"), is_sparse=True)
-    raise Exception(f"Cannot process source: {raw_source}")
-
-
-def load_lockfile(path: Path) -> Lockfile:
-    with path.open("rb") as f:
-        cargo_lock_toml = tomllib.load(f)
-
-    # The `version` key missing means either lockfile v1 or v2. We assume v2 for now.
-    lockfile_version = cargo_lock_toml.get("version", 2)
-
-    raw_packages: list[dict[str, str]] = cargo_lock_toml["package"]
-
-    sources: list[Source] = []
-    raw_source_to_source: dict[str, Source] = {}
-
-    # we'll mark every source with an index in order of appearance
-    # both git and registry sources have a different incrementing index
-    # we reserve registry index 0 for both of the default crates-io registries
-
-    for raw_source in ["registry+https://github.com/rust-lang/crates.io-index", "sparse+https://index.crates.io/"]:
-        source = parse_source(raw_source, lockfile_version)
-        source.ind = 0
-        sources.append(source)
-        raw_source_to_source[source.raw] = source
-
-    next_registry_ind = 1
-    next_git_ind = 0
-
-    git_selector_tuple_to_git_ind: dict[tuple[str, str | None, str | None], int] = {}
-
-    for raw_pkg in raw_packages:
-        raw_source = raw_pkg.get("source", None)
-        if raw_source is None:  # Skip local dependencies
-            continue
-        if raw_source in raw_source_to_source:
-            continue
-
-        source = parse_source(raw_source, lockfile_version)
-        match source:
-            case RegistrySource():
-                source.ind = next_registry_ind
-                next_registry_ind += 1
-            case GitSource():
-                # git sources may get the same `ind` value if their selectors match
-                tup = (source.url, source.type, source.value)
-                if tup not in git_selector_tuple_to_git_ind:
-                    git_selector_tuple_to_git_ind[tup] = next_git_ind
-                    next_git_ind += 1
-                source.ind = git_selector_tuple_to_git_ind[tup]
-
-        sources.append(source)
-        raw_source_to_source[source.raw] = source
-
-    packages: list[Package] = []
-
-    for raw_pkg in raw_packages:
-        name = raw_pkg["name"]
-        version = raw_pkg["version"]
-        raw_source = raw_pkg.get("source", None)
-        if raw_source is None:  # Skip local dependencies
-            continue
-        source = raw_source_to_source[raw_source]
-
-        match source:
-            case RegistrySource():
-                checksum = raw_pkg.get("checksum", None)
-
-                # lockfile v1 has the checksum values in a separate metadata table
-                if checksum is None:
-                    lockfile_version = 1
-                    checksum_key = f"checksum {name} {version} ({source.raw})"
-                    checksum = cargo_lock_toml["metadata"][checksum_key]
-
-                pkg = RegistryPackage(name, version, source, checksum)
-            case GitSource():
-                pkg = GitPackage(name, version, source)
-
-        packages.append(pkg)
-
-    return Lockfile(lockfile_version, sources, packages)
-
-
-_local = threading.local()
-
-
-def get_session() -> Session:
-    if hasattr(_local, "session"):
-        return _local.session
-
+def create_http_session() -> requests.Session:
     retries = Retry(
-        total=RETRY_COUNT,
-        backoff_factor=BACKOFF_FACTOR,
+        total=5,
+        backoff_factor=0.5,
         status_forcelist=[500, 502, 503, 504]
     )
-    session = Session()
-    session.headers["User-Agent"] = USER_AGENT
+    session = requests.Session()
+    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
     session.mount('http://', HTTPAdapter(max_retries=retries))
     session.mount('https://', HTTPAdapter(max_retries=retries))
-
-    _local.session = session
     return session
 
 
-def download_file_with_checksum(url: str, destination_path: Path) -> str:
-    session = get_session()
+def download_file_with_checksum(session: requests.Session, url: str, destination_path: Path) -> str:
     sha256_hash = hashlib.sha256()
-    with session.get(url, stream=True, timeout=TIMEOUT) as response:
-        response.raise_for_status()
-        with destination_path.open("wb") as file:
+    with session.get(url, stream=True) as response:
+        if not response.ok:
+            raise Exception(f"Failed to fetch file from {url}. Status code: {response.status_code}")
+        with open(destination_path, "wb") as file:
             for chunk in response.iter_content(1024):  # Download in chunks
                 if chunk:  # Filter out keep-alive chunks
                     file.write(chunk)
@@ -228,157 +62,117 @@ def download_file_with_checksum(url: str, destination_path: Path) -> str:
     return checksum
 
 
-# Fetch the config.json file and get the .dl key from it
-# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-def fetch_dl_for_registry_source(source: RegistrySource) -> str:
-    # We hardcode the .dl value for crates-io registries to avoid having to clone the git repo, saving a few seconds
-    if source.ind == 0:
-        return "https://static.crates.io/crates"
+def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
+    # TODO: support other registries
+    #       maybe fetch config.json from the registry root and get the dl key
+    #       See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
+    if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
+        raise Exception("Only the default crates.io registry is supported.")
 
-    eprint(f'Fetching .dl value for registry "{source.url}"')
-    if source.is_sparse:
-        url = source.url + "/config.json"
-
-        # https://doc.rust-lang.org/cargo/reference/registry-web-api.html#web-api
-        headers = {
-            "Content-Type": "application/json",
-            "Accept": "application/json",
-        }
-
-        session = get_session()
-        with session.get(url, headers=headers, timeout=TIMEOUT) as response:
-            response.raise_for_status()
-            registry_config: dict[str, str] = response.json()
-    else:
-        tmp_dir = Path(tempfile.mkdtemp())
-        # use spare-checkout to only get the config.json file from the registry's git repo
-        # --quiet is deliberately not used to be able to debug if something goes wrong
-        cmd = ["nix-prefetch-git", "--builder", "--url", source.url, "--rev", "HEAD", "--sparse-checkout", "config.json", "--out", str(tmp_dir)]
-        subprocess.check_output(cmd)
-        with (tmp_dir / "config.json").open("rb") as f:
-            registry_config: dict[str, str] = json.load(f)
-
-    dl = registry_config["dl"]
-
-    auth_required = registry_config.get("auth-required", False)
-    if auth_required:
-        raise Exception(f'Registry "{source.url}" requires authentication, but it is not yet implemented!')
-
-    return dl
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers.
+    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
 
 
-# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-files
-def name_to_prefix(name: str) -> str:
-    nl = len(name)
-    if nl <= 2:
-        return str(nl)
-    if nl == 3:
-        return "3/" + name[0]
-    return name[0:2] + "/" + name[2:4]
+def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
 
+    url = get_download_url_for_tarball(pkg)
+    filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
 
-# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-def make_download_url_for_tarball(pkg: RegistryPackage, dl: str) -> str:
-    # Assume default substitutions if no substitutions are specified
-    url = dl if "}" in dl else dl + "/{crate}/{version}/download"
+    # TODO: allow legacy checksum specification, see importCargoLock for example
+    #       also, don't forget about the other usage of the checksum
+    expected_checksum = pkg["checksum"]
 
-    prefix = name_to_prefix(pkg.name)
-    url = url.replace("{crate}", pkg.name)
-    url = url.replace("{version}", pkg.version)
-    url = url.replace("{prefix}", prefix)
-    url = url.replace("{lowerprefix}", prefix.lower())
-    url = url.replace("{sha256-checksum}", pkg.checksum)
-    return url
+    tarball_out_dir = out_dir / "tarballs" / filename
+    eprint(f"Fetching {url} -> tarballs/{filename}")
 
-
-def download_crate_tarball(url: str, out_path: Path, expected_checksum: str) -> None:
-    out_path.parent.mkdir(parents=True, exist_ok=True)
-
-    eprint(f"Fetching {url} -> {out_path}")
-    calculated_checksum = download_file_with_checksum(url, out_path)
+    calculated_checksum = download_file_with_checksum(session, url, tarball_out_dir)
 
     if calculated_checksum != expected_checksum:
         raise Exception(f"Hash mismatch! File fetched from {url} had checksum {calculated_checksum}, expected {expected_checksum}.")
 
 
 def download_git_tree(url: str, git_sha_rev: str, out_dir: Path) -> None:
+
     tree_out_dir = out_dir / "git" / git_sha_rev
-
-    # This could happen if different selectors point to the same git_sha_rev
-    if tree_out_dir.exists():
-        eprint(f"Skipping fetching {url}#{git_sha_rev} as it has already been downloaded")
-        return
-
-    tree_out_dir.mkdir(parents=True)
-
     eprint(f"Fetching {url}#{git_sha_rev} -> git/{git_sha_rev}")
 
     cmd = ["nix-prefetch-git", "--builder", "--quiet", "--fetch-submodules", "--url", url, "--rev", git_sha_rev, "--out", str(tree_out_dir)]
     subprocess.check_output(cmd)
 
 
-def make_tarball_relpath(pkg: RegistryPackage) -> Path:
-    # Instead of .tar.gz we could have used the .crate extension
-    # But we keep using .tar.gz for backwards compat
-    filename = f'{pkg.name}-{pkg.version}.tar.gz'
+GIT_SOURCE_REGEX = re.compile("git\\+(?P<url>[^?]+)(\\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
 
-    # For backwards compat, all crates.io crates (where source.ind == 0)
-    # are stored directly in tarballs/
-    # Crates from other registries are stored in tarballs/registry-{ind}/
-    if pkg.source.ind == 0:
-        reldir = Path("tarballs")
-    else:
-        reldir = Path("tarballs") / f"registry-{pkg.source.ind}"
 
-    return reldir / filename
+class GitSourceInfo(TypedDict):
+    url: str
+    type: str | None
+    value: str | None
+    git_sha_rev: str
+
+
+def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
+    match = GIT_SOURCE_REGEX.match(source)
+    if match is None:
+        raise Exception(f"Unable to process git source: {source}.")
+
+    source_info = cast(GitSourceInfo, match.groupdict(default=None))
+
+    # the source URL is URL-encoded in lockfile_version >=4
+    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
+    if lockfile_version >= 4 and source_info["value"] is not None:
+        source_info["value"] = unquote(source_info["value"])
+
+    return source_info
 
 
 def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    lockfile = load_lockfile(lockfile_path)
+    cargo_lock_toml = load_toml(lockfile_path)
+    lockfile_version = get_lockfile_version(cargo_lock_toml)
+
+    git_packages: list[dict[str, Any]] = []
+    registry_packages: list[dict[str, Any]] = []
+
+    for pkg in cargo_lock_toml["package"]:
+        # ignore local dependenices
+        if "source" not in pkg.keys():
+            eprint(f"Skipping local dependency: {pkg["name"]}")
+            continue
+        source = pkg["source"]
+
+        if source.startswith("git+"):
+            git_packages.append(pkg)
+        elif source.startswith("registry+"):
+            registry_packages.append(pkg)
+        else:
+            raise Exception(f"Can't process source: {source}.")
+
+    git_sha_rev_to_url: dict[str, str] = {}
+    for pkg in git_packages:
+        source_info = parse_git_source(pkg["source"], lockfile_version)
+        git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
 
     out_dir.mkdir(exist_ok=True)
     shutil.copy(lockfile_path, out_dir / "Cargo.lock")
 
-    git_sources = [source for source in lockfile.sources if isinstance(source, GitSource)]
-    registry_sources = [source for source in lockfile.sources if isinstance(source, RegistrySource)]
-    registry_packages = [pkg for pkg in lockfile.packages if isinstance(pkg, RegistryPackage)]
+    # fetch git trees sequentially, since fetching concurrently leads to flaky behaviour
+    if len(git_packages) != 0:
+        (out_dir / "git").mkdir()
+        for git_sha_rev, url in git_sha_rev_to_url.items():
+            download_git_tree(url, git_sha_rev, out_dir)
 
-    # We fetch git trees sequentially because fetching concurrently seemed to cause flaky behaviour
-    for source in git_sources:
-        download_git_tree(source.url, source.git_sha_rev, out_dir)
-
-    raw_registry_source_to_dl: dict[str, str] = {}
-    for source in registry_sources:
-        dl = fetch_dl_for_registry_source(source)
-        eprint(f'Using .dl value of "{dl}" for registry "{source.raw}"')
-        raw_registry_source_to_dl[source.raw] = dl
-
-    eprint(f"Downloading crate tarballs with {MAX_WORKERS} workers...")
-    with ThreadPoolExecutor(max_workers=MAX_WORKERS) as executor:
-        futures: list[Future[None]] = []
-
-        for pkg in registry_packages:
-            dl = raw_registry_source_to_dl[pkg.source.raw]
-            url = make_download_url_for_tarball(pkg, dl)
-
-            out_path = out_dir / make_tarball_relpath(pkg)
-
-            future = executor.submit(download_crate_tarball, url, out_path, pkg.checksum)
-            futures.append(future)
-
-        # fail early if a worker raises an exception
-        done, _ = wait(futures, return_when=FIRST_EXCEPTION)
-        for f in done:
-            e = f.exception()
-            if e is None:
-                continue
-            executor.shutdown(cancel_futures=True)
-            raise Exception(f"Failed to download tarball: {e}")
+    # run tarball download jobs in parallel, with at most 5 concurrent download jobs
+    with mp.Pool(min(5, mp.cpu_count())) as pool:
+        if len(registry_packages) != 0:
+            (out_dir / "tarballs").mkdir()
+            session = create_http_session()
+            tarball_args_gen = ((session, pkg, out_dir) for pkg in registry_packages)
+            pool.starmap(download_tarball, tarball_args_gen)
 
 
 def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
     cmd = ["cargo", "metadata", "--format-version", "1", "--no-deps", "--manifest-path", str(manifest_path)]
-    output = subprocess.check_output(cmd, cwd=manifest_path.parent)
+    output = subprocess.check_output(cmd)
     return json.loads(output)
 
 
@@ -450,7 +244,8 @@ def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_
     shutil.copytree(crate_tree, crate_out_dir, ignore=ignore_func)
     crate_out_dir.chmod(0o755)
 
-    manifest_data = crate_manifest_path.read_text()
+    with open(crate_manifest_path, "r") as f:
+        manifest_data = f.read()
 
     if "workspace" in manifest_data:
         crate_manifest_metadata = get_manifest_metadata(crate_manifest_path)
@@ -473,16 +268,16 @@ def extract_crate_tarball_contents(tarball_path: Path, crate_out_dir: Path) -> N
     subprocess.check_output(cmd)
 
 
-def make_git_source_selector(source: GitSource) -> dict[str, str]:
+def make_git_source_selector(source_info: GitSourceInfo) -> dict[str, str]:
     selector = {}
-    selector["git"] = source.url
-    if source.type is not None:
-        selector[source.type] = source.value
+    selector["git"] = source_info["url"]
+    if source_info["type"] is not None:
+        selector[source_info["type"]] = source_info["value"]
     return selector
 
 
-def make_registry_source_selector(source: RegistrySource) -> dict[str, str]:
-    registry = source.raw if source.is_sparse else source.url
+def make_registry_source_selector(source: str) -> dict[str, str]:
+    registry = source[9:] if source.startswith("registry+") else source
     selector = {}
     selector["registry"] = registry
     return selector
@@ -493,9 +288,14 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
     out_dir.mkdir(exist_ok=True)
     shutil.copy(lockfile_path, out_dir / "Cargo.lock")
 
-    lockfile = load_lockfile(lockfile_path)
+    cargo_lock_toml = load_toml(lockfile_path)
+    lockfile_version = get_lockfile_version(cargo_lock_toml)
 
+    source_to_ind: dict[str, str] = {}
+    selector_to_ind: dict[tuple, str] = {}
     source_config = {}
+    next_registry_ind = 0
+    next_git_ind = 0
 
     def add_source_replacement(
         orig_key: str,
@@ -508,96 +308,112 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
         source_config[orig_key] = orig_selector
         source_config[orig_key]["replace-with"] = vendored_key
 
+    # we reserve registry index 0 for crates-io
+    source_to_ind["registry+https://github.com/rust-lang/crates.io-index"] = "registry-0"
+    source_to_ind["sparse+https://index.crates.io/"] = "registry-0"
     add_source_replacement(
         orig_key="crates-io",
         orig_selector={},  # there is an internal selector defined for the `crates-io` source
         vendored_key="vendored-source-registry-0",
         vendored_dir="@vendor@/source-registry-0"
     )
+    next_registry_ind += 1
 
-    processed_git_inds = set()
+    for pkg in cargo_lock_toml["package"]:
+        # ignore local dependencies
+        if "source" not in pkg.keys():
+            continue
+        source: str = pkg["source"]
+        if source in source_to_ind:
+            continue
 
-    for source in lockfile.sources:
-        match source:
-            case RegistrySource():
-                if source.ind == 0:  # crates-io already handled separately above
-                    continue
+        if source.startswith("git+"):
+            source_info = parse_git_source(source, lockfile_version)
+            selector = make_git_source_selector(source_info)
+            selector_key = (source_info["url"], source_info["type"], source_info["value"])
+            if selector_key in selector_to_ind:
+                ind = selector_to_ind[selector_key]
+            else:
+                ind = f"git-{next_git_ind}"
+                next_git_ind += 1
+                selector_to_ind[selector_key] = ind
                 add_source_replacement(
-                    orig_key=f"original-source-registry-{source.ind}",
-                    orig_selector=make_registry_source_selector(source),
-                    vendored_key=f"vendored-source-registry-{source.ind}",
-                    vendored_dir=f"@vendor@/source-registry-{source.ind}"
+                    orig_key=f"original-source-{ind}",
+                    orig_selector=selector,
+                    vendored_key=f"vendored-source-{ind}",
+                    vendored_dir=f"@vendor@/source-{ind}"
                 )
-            case GitSource():
-                # In some cases multiple git sources can have the same selector, thus the same git ind
-                # but source replacements can't be made for the same selector multiple times
-                if source.ind in processed_git_inds:
-                    continue
-                processed_git_inds.add(source.ind)
+        elif source.startswith("registry+") or source.startswith("sparse+"):
+            ind = f"registry-{next_registry_ind}"
+            next_registry_ind += 1
+            selector = make_registry_source_selector(source)
+            add_source_replacement(
+                orig_key=f"original-source-{ind}",
+                orig_selector=selector,
+                vendored_key=f"vendored-source-{ind}",
+                vendored_dir=f"@vendor@/source-{ind}"
+            )
+        else:
+            raise Exception(f"Can't process source: {source}.")
 
-                add_source_replacement(
-                    orig_key=f"original-source-git-{source.ind}",
-                    orig_selector=make_git_source_selector(source),
-                    vendored_key=f"vendored-source-git-{source.ind}",
-                    vendored_dir=f"@vendor@/source-git-{source.ind}"
-                )
+        source_to_ind[source] = ind
 
     config_path = out_dir / ".cargo" / "config.toml"
     config_path.parent.mkdir()
 
-    with config_path.open("wb") as config_file:
+    with open(config_path, "wb") as config_file:
         tomli_w.dump({"source": source_config}, config_file)
 
-    for pkg in lockfile.packages:
-        match pkg:
-            case RegistryPackage():
-                crate_out_dir = out_dir / f"source-registry-{pkg.source.ind}" / f"{pkg.name}-{pkg.version}"
-                crate_out_dir.parent.mkdir(exist_ok=True)
+    for pkg in cargo_lock_toml["package"]:
 
-                tarball_path = vendor_staging_dir / make_tarball_relpath(pkg)
+        # ignore local dependenices
+        if "source" not in pkg.keys():
+            continue
 
-                extract_crate_tarball_contents(tarball_path, crate_out_dir)
+        source: str = pkg["source"]
+        source_ind = source_to_ind[source]
+        crate_dir_name = f"{pkg["name"]}-{pkg["version"]}"
+        source_dir_name = f"source-{source_ind}"
+        crate_out_dir = out_dir / source_dir_name / crate_dir_name
+        crate_out_dir.parent.mkdir(exist_ok=True)
 
-                # non-git based crates need the package checksum at minimum
-                with (crate_out_dir / ".cargo-checksum.json").open("w") as f:
-                    json.dump({"files": {}, "package": pkg.checksum}, f)
+        if source.startswith("git+"):
 
-            case GitPackage():
-                crate_out_dir = out_dir / f"source-git-{pkg.source.ind}" / f"{pkg.name}-{pkg.version}"
-                crate_out_dir.parent.mkdir(exist_ok=True)
+            source_info = parse_git_source(source, lockfile_version)
 
-                if crate_out_dir.exists():
-                    raise Exception(
-                        f"{crate_out_dir} already exists!\n"
-                        "This likely due to multiple packages having the same name, version and git selector, but not the same locked git revision\n"
-                        "As a workaround, change all conflicting packages to have different git selectors\n"
-                        "e.g. specifying an exact rev=<hash> selector for each affected package in both Cargo.toml and Cargo.lock\n"
-                        "If it is not possible or difficult to do so (e.g. it's a transient dependency), as a hack, you could also consider keeping\n"
-                        "the package with the most up-to-date revision and removing all other duplicated entries from Cargo.lock"
-                    )
+            git_sha_rev = source_info["git_sha_rev"]
+            git_tree = vendor_staging_dir / "git" / git_sha_rev
 
-                git_sha_rev = pkg.source.git_sha_rev
-                git_tree = vendor_staging_dir / "git" / git_sha_rev
+            copy_and_patch_git_crate_subtree(git_tree, pkg["name"], crate_out_dir)
 
-                copy_and_patch_git_crate_subtree(git_tree, pkg.name, crate_out_dir)
+            # git based crates allow having no checksum information
+            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
+                json.dump({"files": {}}, f)
 
-                # git based crates allow having no checksum information
-                with (crate_out_dir / ".cargo-checksum.json").open("w") as f:
-                    json.dump({"files": {}}, f)
+        elif source.startswith("registry+") or source.startswith("sparse+"):
+            filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
+
+            # TODO: change this when non-crates-io registries are supported
+            dir_name = "tarballs"
+
+            tarball_path = vendor_staging_dir / dir_name / filename
+
+            extract_crate_tarball_contents(tarball_path, crate_out_dir)
+
+            # non-git based crates need the package checksum at minimum
+            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
+                json.dump({"files": {}, "package": pkg["checksum"]}, f)
+
+        else:
+            raise Exception(f"Can't process source: {source}.")
 
 
 def main() -> None:
     subcommand = sys.argv[1]
 
     subcommand_func_dict = {
-        "create-vendor-staging": lambda: create_vendor_staging(
-            lockfile_path=Path(sys.argv[2]),
-            out_dir=Path(sys.argv[3])
-        ),
-        "create-vendor": lambda: create_vendor(
-            vendor_staging_dir=Path(sys.argv[2]),
-            out_dir=Path(sys.argv[3])
-        )
+        "create-vendor-staging": lambda: create_vendor_staging(lockfile_path=Path(sys.argv[2]), out_dir=Path(sys.argv[3])),
+        "create-vendor": lambda: create_vendor(vendor_staging_dir=Path(sys.argv[2]), out_dir=Path(sys.argv[3]))
     }
 
     subcommand_func = subcommand_func_dict.get(subcommand)

pkgs/build-support/rust/hooks/cargo-setup-hook.sh

@@ -8,11 +8,6 @@ cargoSetupPostUnpackHook() {
     # it writable. If we're using a tarball, the unpackFile hook already handles
     # this for us automatically.
     if [ -z $cargoVendorDir ]; then
-        if [ -z "$cargoDeps" ]; then
-            echo "ERROR: Missing cargoDeps"
-            exit 1
-        fi
-
         if [ -d "$cargoDeps" ]; then
             local dest=$(stripHash "$cargoDeps")
             cp -Lr --reflink=auto -- "$cargoDeps" "$dest"
@@ -91,77 +86,6 @@ cargoSetupPostPatchHook() {
     echo "Finished cargoSetupPostPatchHook"
 }
 
-cargoUseSystemLibs() {
-  # Sentinel directory that doesn't exist. For packages
-  # Where you tell it directories, but can't force it to only
-  # use system libraries
-  #
-  # Note that this isn't perfect, as some have fallbacks if their probing fails.
-  local -r sentinel_dir="$(mktemp -du nixpkgs.XXXX)/use/system/library"
-
-  # https://docs.rs/system-deps/8.0.0/system_deps/#internally-build-system-libraries
-  export SYSTEM_DEPS_BUILD_INTERNAL="never"
-
-  # https://github.com/aws/aws-lc-rs/blob/741dbf573a64b6a1e1e6b7c1131a0f8153a28441/aws-lc-sys/README.md#automatic-detection
-  export AWS_LC_SYS_USE_SYSTEM="1"
-
-  # https://github.com/rust-openssl/rust-openssl/blob/b46d5ec06144795e8f9e118c44bebd392956917a/openssl-sys/build/main.rs#L53
-  export OPENSSL_NO_VENDOR="1"
-
-  # 1 = Links statically to the vendored one
-  # 0 = Use pkg-config
-  # https://github.com/rust-lang/libz-sys/blob/2ce3271849d85329b668e0bac9f21427ecf8aef9/build.rs#L256
-  export LIBZ_SYS_STATIC="0"
-
-  # https://github.com/rusqlite/rusqlite/blob/db83b9b08d9cab73f912501eefb8df7b100acd7d/libsqlite3-sys/build.rs#L53
-  export LIBSQLITE3_SYS_USE_PKG_CONFIG="1"
-
-  # https://github.com/gyscos/zstd-rs/blob/ad18ca4e275aed9acc3087d7c1c65d03ab67ad6e/zstd-safe/zstd-sys/build.rs#L279
-  export ZSTD_SYS_USE_PKG_CONFIG="1"
-
-  # https://github.com/rust-lang/git2-rs/blob/a00922bcdf0f78419aa5dd0d3643e73ce01672a8/libgit2-sys/build.rs#L95
-  export LIBGIT2_NO_VENDOR="1"
-
-  # https://github.com/sodiumoxide/sodiumoxide/blob/3057acb1a030ad86ed8892a223d64036ab5e8523/libsodium-sys/build.rs#L34
-  export SODIUM_USE_PKG_CONFIG="1"
-
-  # https://github.com/rust-onig/rust-onig/blob/73e63eb3eea6d93d24a4aadf7fea580287750c7d/onig_sys/build.rs#L250
-  export RUSTONIG_SYSTEM_LIBONIG="1"
-
-  # https://github.com/rust-lang/ssh2-rs/blob/0a11bdd4eecf4525e540c30f14b15ab1c07194b7/libssh2-sys/build.rs#L23
-  export LIBSSH2_SYS_USE_PKG_CONFIG="1"
-
-  # We can only supply the src dir.
-  # https://github.com/nginx/ngx-rust/tree/main/nginx-sys#input-variables
-  # Since we don't want to pull it in for every build, we set it to a dummy value
-  # in all builds, but lets the user set it via `env.NGINX_SOURCE_DIR = nginx.src`
-  export NGINX_SOURCE_DIR="${NGINX_SOURCE_DIR:-"$sentinel_dir/nginx/src"}"
-
-  # We can only supply the lib and include dirs
-  # https://github.com/duckdb/duckdb-rs/blob/ea700a79534c8e8c22a9ac685135f15c31de91d3/crates/libduckdb-sys/build.rs#L203
-  # Set to sentinel by default again
-  # There is also a DUCKDB_LIB_DIR var, but I think only one needs to be set.
-  export DUCKDB_DOWNLOAD_LIB="0"
-  export DUCKDB_INCLUDE_DIR="${DUCKDB_INCLUDE_DIR:-"$sentinel_dir/duckdb/include"}"
-
-  # https://github.com/tikv/jemallocator/blob/a181911517adff5331e43dfd9804086f7c392a25/jemalloc-sys/build.rs#L132
-  export JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE:-"$sentinel_dir/lib/libjemalloc"}"
-}
-
-# Cargo defaults to one job per host CPU. Limit builds that invoke Cargo
-# directly (e.g. through Meson or Make) to NIX_BUILD_CORES, like cargoBuildHook.
-# This runs in a phase because stdenv normalizes NIX_BUILD_CORES after
-# sourcing setup hooks.
-cargoSetupBuildJobs() {
-  export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-$NIX_BUILD_CORES}"
-}
-
-postUnpackHooks+=(cargoSetupBuildJobs)
-
-if [[ -z "${dontCargoUseSystemLibs-}" ]]; then
-  preConfigureHooks+=(cargoUseSystemLibs)
-fi
-
 if [ -z "${dontCargoSetupPostUnpack-}" ]; then
   postUnpackHooks+=(cargoSetupPostUnpackHook)
 fi

pkgs/build-support/rust/import-cargo-lock.nix

@@ -187,18 +187,13 @@ let
       let
         crateTarball = fetchCrate pkg registries.${registryIndexUrl};
       in
-      runCommand "${pkg.name}-${pkg.version}"
-        {
-          strictDeps = true;
-          __structuredAttrs = true;
-        }
-        ''
-          mkdir $out
-          tar xf "${crateTarball}" -C $out --strip-components=1
+      runCommand "${pkg.name}-${pkg.version}" { } ''
+        mkdir $out
+        tar xf "${crateTarball}" -C $out --strip-components=1
 
-          # Cargo is happy with largely empty metadata.
-          printf '{"files":{},"package":"${crateTarball.outputHash}"}' > "$out/.cargo-checksum.json"
-        ''
+        # Cargo is happy with largely empty metadata.
+        printf '{"files":{},"package":"${crateTarball.outputHash}"}' > "$out/.cargo-checksum.json"
+      ''
     else if gitParts != null then
       let
         missingHash = throw ''
@@ -229,71 +224,66 @@ let
           else
             missingHash;
       in
-      runCommand "${pkg.name}-${pkg.version}"
-        {
-          strictDeps = true;
-          __structuredAttrs = true;
-        }
-        ''
-          tree=${tree}
+      runCommand "${pkg.name}-${pkg.version}" { } ''
+        tree=${tree}
 
-          # If the target package is in a workspace, or if it's the top-level
-          # crate, we should find the crate path using `cargo metadata`.
-          # Some packages do not have a Cargo.toml at the top-level,
-          # but only in nested directories.
-          # Only check the top-level Cargo.toml, if it actually exists
-          if [[ -f $tree/Cargo.toml ]]; then
-            crateCargoTOML=$(cd "$tree" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $tree/Cargo.toml | \
-            ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path')
-          fi
+        # If the target package is in a workspace, or if it's the top-level
+        # crate, we should find the crate path using `cargo metadata`.
+        # Some packages do not have a Cargo.toml at the top-level,
+        # but only in nested directories.
+        # Only check the top-level Cargo.toml, if it actually exists
+        if [[ -f $tree/Cargo.toml ]]; then
+          crateCargoTOML=$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $tree/Cargo.toml | \
+          ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path')
+        fi
 
-          # If the repository is not a workspace the package might be in a subdirectory.
-          if [[ -z $crateCargoTOML ]]; then
-            for manifest in $(find $tree -name "Cargo.toml"); do
-              echo Looking at $manifest
-              crateCargoTOML=$(cd "$(dirname "$manifest")" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path "$manifest" | ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path' || :)
-              if [[ ! -z $crateCargoTOML ]]; then
-                break
-              fi
-            done
-
-            if [[ -z $crateCargoTOML ]]; then
-              >&2 echo "Cannot find path for crate '${pkg.name}-${pkg.version}' in the tree in: $tree"
-              exit 1
+        # If the repository is not a workspace the package might be in a subdirectory.
+        if [[ -z $crateCargoTOML ]]; then
+          for manifest in $(find $tree -name "Cargo.toml"); do
+            echo Looking at $manifest
+            crateCargoTOML=$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path "$manifest" | ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path' || :)
+            if [[ ! -z $crateCargoTOML ]]; then
+              break
             fi
+          done
+
+          if [[ -z $crateCargoTOML ]]; then
+            >&2 echo "Cannot find path for crate '${pkg.name}-${pkg.version}' in the tree in: $tree"
+            exit 1
           fi
+        fi
 
-          echo Found crate ${pkg.name} at $crateCargoTOML
-          tree=$(dirname $crateCargoTOML)
+        echo Found crate ${pkg.name} at $crateCargoTOML
+        tree=$(dirname $crateCargoTOML)
 
-          cp -prvL "$tree" "$out" || echo "Warning: certain files couldn't be copied!" >&2
-          chmod u+w $out
+        cp -prvL "$tree" "$out" || echo "Warning: certain files couldn't be copied!" >&2
+        chmod u+w $out
 
-          if grep -q workspace "$out/Cargo.toml"; then
-            chmod u+w "$out/Cargo.toml"
-            ${replaceWorkspaceValues} "$out/Cargo.toml" "$(cd "$tree" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $crateCargoTOML | ${jq}/bin/jq -r .workspace_root)/Cargo.toml"
-          fi
+        if grep -q workspace "$out/Cargo.toml"; then
+          chmod u+w "$out/Cargo.toml"
+          ${replaceWorkspaceValues} "$out/Cargo.toml" "$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $crateCargoTOML | ${jq}/bin/jq -r .workspace_root)/Cargo.toml"
+        fi
 
-          # Cargo is happy with empty metadata.
-          printf '{"files":{},"package":null}' > "$out/.cargo-checksum.json"
+        # Cargo is happy with empty metadata.
+        printf '{"files":{},"package":null}' > "$out/.cargo-checksum.json"
 
-          ${optionalString (gitParts ? type) ''
-            gitPartsValue=${escapeShellArg gitParts.value}
-            # starting with lockfile version v4 the git source url contains encoded query parameters
-            # our regex parser does not know how to unescape them to get the actual value, so we do it here
-            ${optionalString (lockFileVersion >= 4) ''
-              gitPartsValue=$(${getExe python3Packages.python} -c "import sys, urllib.parse; print(urllib.parse.unquote(sys.argv[1]))" "$gitPartsValue")
-            ''}
+        ${optionalString (gitParts ? type) ''
+          gitPartsValue=${escapeShellArg gitParts.value}
+          # starting with lockfile version v4 the git source url contains encoded query parameters
+          # our regex parser does not know how to unescape them to get the actual value, so we do it here
+          ${optionalString (lockFileVersion >= 4) ''
+            gitPartsValue=$(${getExe python3Packages.python} -c "import sys, urllib.parse; print(urllib.parse.unquote(sys.argv[1]))" "$gitPartsValue")
           ''}
+        ''}
 
-          # Set up configuration for the vendor directory.
-          cat > $out/.cargo-config <<EOF
-          [source."${pkg.source}"]
-          git = "${gitParts.url}"
-          ${optionalString (gitParts ? type) "${gitParts.type} = \"$gitPartsValue\""}
-          replace-with = "vendored-sources"
-          EOF
-        ''
+        # Set up configuration for the vendor directory.
+        cat > $out/.cargo-config <<EOF
+        [source."${pkg.source}"]
+        git = "${gitParts.url}"
+        ${optionalString (gitParts ? type) "${gitParts.type} = \"$gitPartsValue\""}
+        replace-with = "vendored-sources"
+        EOF
+      ''
     else
       throw "Cannot handle crate source: ${pkg.source}";
 
@@ -301,7 +291,6 @@ let
     runCommand "cargo-vendor-dir"
       (
         {
-          strictDeps = true;
           __structuredAttrs = true;
         }
         // (

pkgs/build-support/rust/test/fetch-cargo-vendor/default.nix

@@ -1,4 +0,0 @@
-{ callPackage }:
-{
-  gitDependencyCargoConfig = callPackage ./git-dependency-cargo-config { };
-}

pkgs/build-support/rust/test/fetch-cargo-vendor/git-dependency-cargo-config/default.nix

@@ -1,6 +0,0 @@
-{ rustPlatform }:
-rustPlatform.fetchCargoVendor {
-  name = "git-dependency-cargo-config";
-  src = ../../import-cargo-lock/git-dependency-cargo-config;
-  hash = "sha256-rUQQ4Xrk+rW5Vgm7GK8xrK9zcwazsmBO6Q6qTCUniWc=";
-}

pkgs/build-support/rust/test/import-cargo-lock/default.nix

@@ -17,7 +17,6 @@
       { };
   gitDependencyTag = callPackage ./git-dependency-tag { };
   gitDependencyBranch = callPackage ./git-dependency-branch { };
-  gitDependencyCargoConfig = callPackage ./git-dependency-cargo-config { };
   maturin = maturin.tests.pyo3;
   v1 = callPackage ./v1 { };
   gitDependencyWorkspaceInheritance = callPackage ./git-dependency-workspace-inheritance {

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-cargo-config/Cargo.lock

@@ -1,13 +0,0 @@
-version = 3
-
-[[package]]
-name = "fixture"
-version = "0.1.0"
-dependencies = [
- "bootloader",
-]
-
-[[package]]
-name = "bootloader"
-version = "0.11.17"
-source = "git+https://github.com/rust-osdev/bootloader.git?rev=3d7f72e36d4101ecf78b70cef2475d700bb01721#3d7f72e36d4101ecf78b70cef2475d700bb01721"

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-cargo-config/default.nix

@@ -1,8 +0,0 @@
-{ rustPlatform }:
-rustPlatform.importCargoLock {
-  lockFile = ./Cargo.lock;
-  outputHashes = {
-    # Bootloader's .cargo/config.toml enables bindeps, which are required to parse its manifest.
-    "bootloader-0.11.17" = "sha256-mLm5M1HLipN1EzS1zbDgMxMOqNySivGsK8+i0uOmoFM=";
-  };
-}

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -33,8 +33,6 @@ assertExecutable() {
 
 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
-# --prefix-unchecked ENV SEP VAL  : same as --prefix/--suffix, accepted for compatibility
-# --suffix-unchecked                with makeBinaryWrapper
 # --prefix-each     ENV SEP VALS  : like --prefix, but VALS is a list
 # --suffix-each     ENV SEP VALS  : like --suffix, but VALS is a list
 # --prefix-contents ENV SEP FILES : like --suffix-each, but contents of FILES
@@ -147,7 +145,7 @@ makeShellWrapper() {
             command="${params[$((n + 1))]}"
             n=$((n + 1))
             echo "$command" >> "$wrapper"
-        elif [[ ("$p" == "--suffix") || ("$p" == "--prefix") || ("$p" == "--suffix-unchecked") || ("$p" == "--prefix-unchecked") ]]; then
+        elif [[ ("$p" == "--suffix") || ("$p" == "--prefix") ]]; then
             varName="${params[$((n + 1))]}"
             separator="${params[$((n + 2))]}"
             value="${params[$((n + 3))]}"

pkgs/build-support/wrapper-common/utils.bash

@@ -150,67 +150,6 @@ expandResponseParams() {
     done
 }
 
-# Resolve the path $1 of a library directory, which like the linker
-# takes a relative path from the working directory, to the directory the
-# linker searches, as far as needed to tell whether it is in the store,
-# and where.  Like the kernel, follow each symlink before going on to the
-# next component, so that symlinks in ancestor directories count, and `..`
-# applies to the target of a symlink rather than removing it.  But in the
-# store, keep symlinks that are not followed by `..` as they are, since
-# resolving symlinks between store paths would refer to their targets
-# instead (see issue #454199).  The result is stored in resolvedPath.
-# Fails if there are too many symlinks.
-resolveLibDir() {
-    local rest="$1/" component link target links=0
-    # The common case: a path in the store with no `.`, `..` or empty
-    # components is already resolved, since it has no symlink to follow.
-    if [[ "$1" == "${NIX_STORE:-}"/* && "$1/" != */./* && "$1/" != */../* && "$1/" != *//* ]]; then
-        resolvedPath="$1"
-        return
-    fi
-    if [[ "$rest" != /* ]]; then
-        rest="$PWD/$rest"
-    fi
-    resolvedPath=
-    while [[ -n "$rest" ]]; do
-        component="${rest%%/*}"
-        rest="${rest#*/}"
-        case "$component" in
-            "" | .) continue ;;
-            ..)
-                if [[ -L "$resolvedPath" ]]; then
-                    # Follow it, then apply this `..` to its target.
-                    link="$resolvedPath"
-                    resolvedPath="${resolvedPath%/*}"
-                    rest="../$rest"
-                else
-                    resolvedPath="${resolvedPath%/*}"
-                    continue
-                fi
-                ;;
-            *)
-                link="$resolvedPath/$component"
-                # Keep a symlink in the store unless `..` follows it, and
-                # never resolve the store or its ancestors, which may be
-                # symlinks (NIX_IGNORE_SYMLINK_STORE).
-                if [[ "$link" == "${NIX_STORE:-}"/* || "${NIX_STORE:-}/" == "$link"/* || ! -L "$link" ]]; then
-                    resolvedPath="$link"
-                    continue
-                fi
-                ;;
-        esac
-        (( ++links <= 40 )) || return 1
-        target=$(readlink "$link") || return 1
-        # A relative target is relative to the directory containing the
-        # link, which is now resolvedPath.
-        if [[ "$target" == /* ]]; then
-            resolvedPath=
-        fi
-        rest="$target/$rest"
-    done
-    resolvedPath="${resolvedPath:-/}"
-}
-
 checkLinkType() {
     local arg
     type="dynamic"

pkgs/by-name/_7/_7kaa/package.nix

@@ -66,7 +66,7 @@ gccStdenv.mkDerivation (finalAttrs: {
     autoupdate
   '';
 
-  hardeningDisable = lib.optionals stdenv.hostPlatform.isDarwin [
+  hardeningDisable = lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin) [
     "stackprotector"
   ];
 

pkgs/by-name/_9/_9base/package.nix

@@ -92,6 +92,6 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     # needs additional work to support aarch64-darwin
     # due to usage of _DARWIN_NO_64_BIT_INODE
-    broken = stdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/by-name/ab/abseil-cpp_202608/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  fixDarwinDylibNames,
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
@@ -23,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
-    # Test helper libraries linking against GoogleTest
-    "testing"
   ];
 
   cmakeFlags = [
@@ -38,22 +35,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+  nativeBuildInputs = [ cmake ];
 
   buildInputs = [ gtest ];
 
-  postInstall = ''
-    for lib in scoped_mock_log status_matchers; do
-      moveToOutput "lib/libabsl_$lib.*" "$testing"
-      substituteInPlace $out/lib/cmake/absl/abslTargets-*.cmake \
-        --replace-fail "$out/lib/libabsl_$lib." "$testing/lib/libabsl_$lib."
-      substituteInPlace "$out/lib/pkgconfig/absl_$lib.pc" \
-        --replace-fail "libdir=$out/lib" "libdir=$testing/lib"
-    done
-  '';
-
-  outputChecks.out.disallowedRequisites = [ gtest ];
-
   __structuredAttrs = true;
 
   meta = {

pkgs/by-name/ac/aclpubcheck/package.nix

@@ -17,6 +17,8 @@ python3Packages.buildPythonApplication {
     hash = "sha256-s9kegTZOZEgGx0Yj8jOfzAyjyy1EuabOybMDBoodRvo=";
   };
 
+  __structuredAttrs = true;
+
   build-system = with python3Packages; [
     setuptools
   ];

pkgs/by-name/ac/acpica-tools/package.nix

@@ -45,7 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
     # ACPICA emits packed structs that produce unaligned pointers. Apple's
     # arm64 linker rejects these under chained fixups; opt back into the
     # legacy fixup format so the link succeeds.
-    NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-no_fixup_chains";
+    NIX_LDFLAGS = lib.optionalString (
+      stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
+    ) "-no_fixup_chains";
 
     # i686 builds fail with hardening enabled (due to -Wformat-overflow). Disable
     # -Werror altogether to make this derivation less fragile to toolchain

pkgs/by-name/ad/adguardian/package.nix

@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  pkg-config,
-  aws-lc,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -20,14 +18,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-uch2JKnskO5W8EPK877qL0aQQ+iInHJoCrrhZbmoVRs=";
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    aws-lc
-  ];
-
   meta = {
     description = "Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance";
     mainProgram = "adguardian";

pkgs/by-name/ad/adpathfinder/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.2.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "NetSPI";
     repo = "AD-PathFinder";

pkgs/by-name/ad/adscan/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "13.2.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "ADScanPro";
     repo = "adscan";

pkgs/by-name/ad/advi/package.nix

@@ -16,9 +16,9 @@ let
     case "$1 $2" in
       "config var")
         case "$3" in
-          man) echo "''${man:-$out}/share/man";;
+          man) echo "$out/share/man";;
           etc) echo "$out/etc";;
-          doc) echo "''${doc:-$out}/share/doc";;
+          doc) echo "$out/share/doc";;
           share) echo "$out/share";;
           prefix) echo "$out";;
           *) echo "fake-opam does not understand arguments: $@" ; exit 1 ;;
@@ -46,7 +46,7 @@ ocamlPackages.buildDunePackage rec {
   postPatch = ''
     substituteInPlace ./Makefile \
       --replace "\$(DUNE) install \$(DUNEROOT) --display=short" \
-      "\$(DUNE) install \$(DUNEROOT) --prefix $out --docdir ''${!outputDoc}/share/doc --mandir ''${!outputMan}/share/man"
+      "\$(DUNE) install \$(DUNEROOT) --prefix $out --docdir $out/share/doc --mandir $out/share/man"
     substituteInPlace ./src/discover.sh \
       --replace 'gs_path=$(which gs)' 'gs_path=${ghostscriptX}/bin/gs'
   '';

pkgs/by-name/ad/adwaita-fonts/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adwaita-fonts";
-  version = "51.0";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-fonts/${lib.versions.major finalAttrs.version}/adwaita-fonts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+hBK4sG5ZYDTIvVj/+iy38pSlrDspJce/S2AEUBRI9I=";
+    hash = "sha256-TJJ/v+7BxQOAG6UQwslOAFTILFIs97oNO+XU1B/PXIY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adwaita-icon-theme/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "adwaita-icon-theme";
-  version = "51.0";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major finalAttrs.version}/adwaita-icon-theme-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ulYc88ljBaRxefpWBYVq1pXJI46gf3CTrr2bqAxOMjs=";
+    hash = "sha256-+sbgQB/KcUeAVhoIG49+J8O8HbNOvaTaF1CB8msk1GA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ag/agentsploit/package.nix

@@ -11,6 +11,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.7.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "agentsploit";
     repo = "agentsploit";
@@ -50,7 +52,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   disabledTestPaths = [
     # Tests need network access
-    "tests/unit/test_openai_adapter.py"
     "tests/integration/"
   ];
 

pkgs/by-name/ap/apache-airflow/python-package.nix

@@ -397,6 +397,8 @@ buildPythonPackage (
     pname = "apache-airflow";
     version = "3.3.2";
 
+    __structuredAttrs = true;
+
     src = fetchFromGitHub {
       owner = "apache";
       repo = "airflow";

pkgs/by-name/ap/apl387/package.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "apl387";
-  version = "2026-10-30";
+  version = "2026-08-17";
 
   src = fetchFromGitHub {
     owner = "dyalog";
     repo = "APL387";
     tag = finalAttrs.version;
-    hash = "sha256-UdKSmbZoGAy8g9FfVGz8/n+2BY9tBSulcpkWRqLZ+eg=";
+    hash = "sha256-KeXZOX5ZSZjhrgN54w2yHpiOhTnk9NU3F8jh/AR1l44=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/apm-cli/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "0.35.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "apm";

pkgs/by-name/ap/apt-swarm/package.nix

@@ -2,16 +2,12 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  pkg-config,
-  aws-lc,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "apt-swarm";
   version = "0.6.1";
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = "apt-swarm";
@@ -21,10 +17,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-Fo/+UbdfDhbAsoWjoko4tAmyDZK6tPn/0d2CjPKyaaQ=";
 
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ aws-lc ];
-
   meta = {
     description = "Experimental p2p gossip network for OpenPGP signature transparency";
     homepage = "https://github.com/kpcyrd/apt-swarm";

pkgs/by-name/aq/aqtinstall/package.nix

@@ -9,6 +9,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "aqtinstall";
   version = "3.3.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "miurahr";

pkgs/by-name/ar/argocd/package.nix

@@ -5,57 +5,47 @@
   installShellFiles,
   nix-update-script,
   stdenv,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpm_10,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
   nodejs,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "argocd";
-  version = "3.5.6";
+  version = "3.4.6";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gv/7K3eU80ncOyHq/OPKneQTOVcsuYkJ2F9YiqNOdEU=";
+    hash = "sha256-Dpn4KHKs766/cmh0gLwaFExQ2tMRbdXZK+2v2jM3iF8=";
   };
 
-  ui = stdenv.mkDerivation (uiAttrs: {
+  ui = stdenv.mkDerivation {
     pname = "argocd-ui";
     inherit (finalAttrs) version;
     src = finalAttrs.src + "/ui";
 
-    pnpmDeps = fetchPnpmDeps {
-      inherit (uiAttrs) pname version src;
-      pnpm = pnpm_10;
-      fetcherVersion = 4;
-      hash = "sha256-WO0wDFGESRaWVbiXkHm6oX1CNAvYiScL60Vta4/FVAI=";
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${finalAttrs.src}/ui/yarn.lock";
+      hash = "sha256-/B7FviD0a3VDmbbM59Ksmr8apuTRHrRbTtfX4QgO8JM=";
     };
 
     nativeBuildInputs = [
-      pnpmConfigHook
-      pnpm_10
+      yarnConfigHook
+      yarnBuildHook
       nodejs
     ];
 
-    buildPhase = ''
-      runHook preBuild
-      pnpm run build
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
+    postInstall = ''
       mkdir -p $out
       cp -r dist $out/dist
-      runHook postInstall
     '';
-  });
+  };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-RxBSSnCBcFEXP5iZo6nr5FihOIJH4dYB2bMHbvqANQc=";
+  vendorHash = "sha256-yzVSMdupFdrYUWMCPFhiYTnjCDGZo4Se0osXbCvB7gM=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile

pkgs/by-name/ar/arnis/package.nix

@@ -4,7 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   cargo-tauri,
-  cacert,
   wrapGAppsHook4,
   webkitgtk_4_1,
   pkg-config,
@@ -13,17 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arnis";
-  version = "3.3.0";
-  __structuredAttrs = true;
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "louis-e";
     repo = "arnis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fn2YGDJVb8ICfVOxVCUzPR+T+aYJr83e95O7YXxh+AE=";
+    hash = "sha256-BS+kzgVE3DnFrV1V5FQuKG0cytbFhcLZdJbXNPAvcmc=";
   };
 
-  cargoHash = "sha256-tPOHSiX7md/ga0+0ROB0Ar4/ZRW/Vifl/4XlxULOzbU=";
+  cargoHash = "sha256-h8dy4ZdQFY8tYS9fuV4p6FM0IrFFWgJrhM5Dd8L96Yc=";
 
   nativeBuildInputs = [
     cargo-tauri.hook
@@ -38,18 +36,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     webkitgtk_4_1
   ];
 
-  nativeCheckInputs = [ cacert ];
-
   checkFlags = [
-    # Fetches OSM data from Overpass, which the build sandbox does not allow
+    # Fail to run in sandbox environment
     "--skip=map_transformation::translate::translator::tests::test_translate_by_vector"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
-    # Passes on x86_64, but overflows the test-thread stack on aarch64
-    "--skip=world_editor::bedrock::leveldb_options_tests::bedrock_db_survives_heavy_compaction"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    "--skip=mapillary::fetch::tests::the_run_counts_what_it_asked_of_the_network"
   ];
 
   nativeInstallCheckInputs = [
@@ -68,8 +57,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "${placeholder "out"}/${binSubdirectory}/arnis";
   doInstallCheck = true;
 
-  __darwinAllowLocalNetworking = true;
-
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/ar/arrow-cpp/package.nix

@@ -172,6 +172,10 @@ stdenv.mkDerivation (finalAttrs: {
               "TestS3FS.*"
               "TestS3FSGeneric.*"
               "TestS3FSHTTPS.*" # Needs Minio
+            ]
+            ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+              # https://github.com/apache/arrow/issues/41505
+              "TestAzuriteGeneric.Empty"
             ];
         in
         "-${lib.concatStringsSep ":" filteredTests}";
@@ -348,6 +352,8 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
+    # https://hydra.nixos.org/job/nixpkgs/unstable/arrow-cpp.x86_64-darwin/all
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64;
     description = "Cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/docs/cpp/";
     changelog = "https://arrow.apache.org/release/${finalAttrs.version}.html";

pkgs/by-name/ar/arti/package.nix

@@ -6,7 +6,6 @@
   pkg-config,
   sqlite,
   openssl,
-  zstd,
   versionCheckHook,
   nix-update-script,
   nixosTests,
@@ -37,13 +36,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildAndTestSubdir = "crates/arti";
   cargoHash = "sha256-g+t5X1t0koUzqoHpY8+lncqRobdDuZggXtD3HRk9ryE=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
-  buildInputs = [
-    sqlite
-    zstd
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
+  buildInputs = [ sqlite ] ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   # `full` includes all stable and non-conflicting feature flags. the primary
   # downsides are increased binary size and memory usage for building, but

pkgs/by-name/as/asciidoc/package.nix

@@ -7,7 +7,7 @@
   autoreconfHook,
   installShellFiles,
   enableStandardFeatures ? false,
-  source-highlight,
+  sourceHighlight,
   highlight,
   graphviz,
   texliveMinimal,
@@ -246,7 +246,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
             -e "s|run('convert|run('${lib.getExe' imagemagick "convert"}|g" \
             -i "asciidoc/resources/filters/music/music2png.py"
 
-        sed -e 's|filter="source-highlight|filter="${source-highlight}/bin/source-highlight|' \
+        sed -e 's|filter="source-highlight|filter="${sourceHighlight}/bin/source-highlight|' \
             -e 's|filter="highlight|filter="${highlight}/bin/highlight|' \
             -e 's|filter="pygmentize|filter="${pygments}/bin/pygmentize|' \
             -i "asciidoc/resources/filters/source/source-highlight-filter.conf"
@@ -283,10 +283,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   )
   + ''
     # Fix tests
-    substituteInPlace $(grep -R --files-with-matches "2002-11-25" tests/data) \
-      --replace-fail "2002-11-25" "1980-01-02"
-    substituteInPlace $(grep -R --files-with-matches "00:37:42" tests/data) \
-      --replace-fail "00:37:42" "00:00:00"
+    for f in $(grep -R --files-with-matches "2002-11-25") ; do
+      substituteInPlace $f --replace "2002-11-25" "1980-01-02"
+      substituteInPlace $f --replace "00:37:42" "00:00:00"
+    done
   ''
   + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     # We want to use asciidoc from the build platform to build the documentation.
@@ -317,6 +317,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     runHook postCheck
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Text-based document generation system";
     longDescription = ''

pkgs/by-name/as/asciimol/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.2.7";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchPypi {
     inherit (finalAttrs) pname version;
     hash = "sha256-SqwViOnVx1TcpY8Kd5VQCg1A8KQnBhL8aq9Gsrwer3k=";

pkgs/by-name/as/asl/package.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionalString (!buildDocs) ''
       substituteInPlace Makefile --replace "all: binaries docs" "all: binaries"
     ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
       substituteInPlace sysdefs.h --replace "x86_64" "aarch64"
     '';
 

pkgs/by-name/at/at-spi2-core/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.62.0";
+  version = "2.60.6";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-A6lPe/NfMA2vKEOjfN82R5qRvFP1mo6kN8eeJdldHeM=";
+    hash = "sha256-qJtkqLIXqAQr3w41y/q2Kc7uNWQNunXfV4r96ap4nVc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/at/atari800/package.nix

@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  SDL2,
+  SDL,
   autoreconfHook,
   fetchFromGitHub,
   libGL,
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atari800";
-  version = "7.2.1";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "atari800";
     repo = "atari800";
     rev = "ATARI800_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-cDiEFPE9JPonLdlBcKWZ1FGDMAQwuVihYtshcd8bcyM=";
+    hash = "sha256-D66YRRTqdoV9TqDFonJ9XNpfP52AicuYgdiW27RCIuQ=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    SDL2
+    SDL
     libGL
     libGLU
     libx11
@@ -41,13 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature true "opengl")
     (lib.withFeature true "readline")
     (lib.withFeature true "x")
-    (lib.withFeatureAs true "sound" "sdl2")
-    (lib.withFeatureAs true "video" "sdl2")
+    (lib.withFeatureAs true "sound" "sdl")
+    (lib.withFeatureAs true "video" "sdl")
   ];
 
   meta = {
     homepage = "https://atari800.github.io/";
-    changelog = "https://github.com/atari800/atari800/releases/tag/${finalAttrs.src.rev}";
     description = "Atari 8-bit emulator";
     longDescription = ''
       Atari800 is the emulator of Atari 8-bit computer systems and 5200 game

pkgs/by-name/au/autogen/package.nix

@@ -8,7 +8,7 @@
   which,
   pkg-config,
   perl,
-  guile,
+  guile_2_2,
   libxml2,
 }:
 
@@ -101,7 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildPackages.texinfo
   ];
   buildInputs = [
-    guile
+    guile_2_2
     libxml2
   ];
 

pkgs/by-name/au/autopush-rs/package.nix

@@ -24,6 +24,8 @@ let
       pname = "fernet_key";
       inherit version src;
 
+      __structuredAttrs = true;
+
       format = "other";
 
       # this would run the upstream docker makefile

pkgs/by-name/av/avalonia-ilspy/package.nix

@@ -51,7 +51,7 @@ buildDotnetModule rec {
     bintools
     fixDarwinDylibNames
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     autoSignDarwinBinariesHook
   ];
 

pkgs/by-name/aw/aw-watcher-steam/package.nix

@@ -9,6 +9,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "aw-watcher-steam";
   version = "0-unstable-2025-06-16";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Edwardsoen";

pkgs/by-name/aw/aws-lc/package.nix

@@ -99,6 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
       ];
     mainProgram = "bssl";
     maintainers = with lib.maintainers; [
+      theoparis
       whispersofthedawn
     ];
     pkgConfigModules = [

pkgs/by-name/aw/aws-rotate-key/package.nix

@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
     description = "Easily rotate your AWS key";
     homepage = "https://github.com/stefansundin/aws-rotate-key";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.mbode ];
     mainProgram = "aws-rotate-key";
   };
 })

pkgs/by-name/aw/awscurl/package.nix

@@ -8,6 +8,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "awscurl";
   version = "0.44";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "okigan";

pkgs/by-name/az/azurefox/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.5.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "TacoRocket";
     repo = "AzureFox";

pkgs/by-name/az/azurite/package.nix

@@ -32,10 +32,6 @@ buildNpmPackage (finalAttrs: {
     libsecret
   ];
 
-  # @vscode/vsce-sign's postinstall script fails on exotic architectures.
-  # We ignore the scripts, and this does not change the output.
-  npmFlags = [ "--ignore-scripts" ];
-
   meta = {
     description = "Lightweight server clone of Azure Storage that simulates most of the commands supported by it with minimal dependencies";
     homepage = "https://github.com/Azure/Azurite";

pkgs/by-name/ba/babeldoc/package.nix

@@ -12,6 +12,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "babeldoc";
   version = "0.6.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "funstory-ai";

pkgs/by-name/ba/bandcampsync/package.nix

@@ -9,6 +9,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   version = "0.8.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "meeb";
     repo = "bandcampsync";

pkgs/by-name/ba/bat/package.nix

@@ -6,7 +6,6 @@
   less,
   installShellFiles,
   makeWrapper,
-  oniguruma,
   libgit2,
   zlib,
   versionCheckHook,
@@ -36,7 +35,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   buildInputs = [
-    oniguruma
     libgit2
     zlib
   ];

pkgs/by-name/ba/batmon/package.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     mainProgram = "batmon";
     platforms = with lib.platforms; unix ++ windows;
-    broken = stdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
     maintainers = with lib.maintainers; [ _6543 ];
   };
 })

pkgs/by-name/ba/bazaar/package.nix

@@ -1,15 +1,13 @@
 {
   lib,
   stdenv,
-  fetchFromGitLab,
+  fetchFromGitHub,
   blueprint-compiler,
   desktop-file-utils,
-  dbus,
   meson,
   python3,
   ninja,
   pkg-config,
-  vala,
   wrapGAppsHook4,
   appstream,
   flatpak,
@@ -31,13 +29,12 @@
   md4c,
   webkitgtk_6_0,
   libsecret,
-  systemdLibs,
   nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.9.9";
+  version = "0.9.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -49,12 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "World";
+  src = fetchFromGitHub {
+    owner = "bazaar-org";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qmMwlvB8DXNP0SHip1mQoktYFeH/DwfvVtVIny16Ryo=";
+    hash = "sha256-9J+XI5JnV8Yfk3xRI/VM5RSG4eMafbw2rBRpPMIu5yA=";
   };
 
   nativeBuildInputs = [
@@ -64,7 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    vala
     wrapGAppsHook4
     (python3.withPackages (p: [
       p.babel
@@ -74,7 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     appstream
-    dbus
     flatpak
     glib-networking
     gtk4
@@ -93,7 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
     md4c
     webkitgtk_6_0
     libsecret
-    systemdLibs
   ];
 
   postInstall = ''
@@ -119,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "FlatHub-first app store for GNOME";
-    homepage = "https://gitlab.gnome.org/World/bazaar";
+    homepage = "https://github.com/kolunmi/bazaar";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       dtomvan

pkgs/by-name/ba/bazarr/package.nix

@@ -31,6 +31,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     webrtcvad
   ];
 
+  __structuredAttrs = true;
   dontBuild = true;
   dontWrapPythonPrograms = true;
   pyproject = false;

pkgs/by-name/ba/bazel_7/package.nix

@@ -118,6 +118,11 @@ let
           url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-arm64";
           hash = "sha256-wfuZLSHa77wr0A4ZLF5DqH7qyOljYNXM2a5imoS+nGQ";
         }
+      else if stdenv.hostPlatform.system == "x86_64-darwin" then
+        fetchurl {
+          url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-darwin-x86_64";
+          hash = "sha256-qAb9s6R5+EbqVfWHUT7sk1sOrbDEPv4EhgXH7nC46Zw=";
+        }
       else
         fetchurl {
           # stdenv.hostPlatform.system == "aarch64-darwin"
@@ -279,12 +284,12 @@ let
 
   platforms = lib.platforms.linux ++ lib.platforms.darwin;
 
-  inherit (stdenv.hostPlatform) isDarwin;
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
 
   system = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  arch = if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
+  arch = with stdenv.hostPlatform; if isDarwin && isAarch64 then "arm64" else parsed.cpu.name;
 
   bazelRC = writeTextFile {
     name = "bazel-rc";

pkgs/by-name/ba/bazel_8/package.nix

@@ -36,13 +36,12 @@
 
 let
   inherit (callPackage ./build-support/patching.nix { }) addFilePatch;
-  inherit (stdenv.hostPlatform) isDarwin;
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
 
   bazelSystem = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  bazelArch =
-    if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
+  bazelArch = if isDarwin && isAarch64 then "arm64" else stdenv.hostPlatform.parsed.cpu.name;
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";

pkgs/by-name/ba/bazel_9/package.nix

@@ -34,7 +34,7 @@
 
 let
   inherit (callPackage ./build-support/patching.nix { }) addFilePatch;
-  inherit (stdenv.hostPlatform) isDarwin;
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
 
   defaultShellUtils =
     # Keep this list conservative. For more exotic tools, prefer to use
@@ -85,8 +85,7 @@ let
   bazelSystem = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  bazelArch =
-    if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
+  bazelArch = if isDarwin && isAarch64 then "arm64" else stdenv.hostPlatform.parsed.cpu.name;
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";

pkgs/by-name/bi/bic/package.nix

@@ -59,6 +59,6 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ hexagonal-sun ];
     # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
   };
 }

pkgs/by-name/bi/bicep-lsp/package.nix

@@ -43,7 +43,7 @@ buildDotnetModule rec {
     stdenv.cc.cc.lib
   ];
 
-  doCheck = !stdenv.hostPlatform.isDarwin; # mono is not available on aarch64-darwin
+  doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64); # mono is not available on aarch64-darwin
 
   meta = {
     description = "Domain Specific Language (DSL) for deploying Azure resources declaratively";

pkgs/by-name/bi/bigloo/package.nix

@@ -71,6 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ thoughtpolice ];
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64; # segfault during build
 
     longDescription = ''
       Bigloo is a Scheme implementation devoted to one goal: enabling

pkgs/by-name/bi/bitbake-setup/package.nix

@@ -13,6 +13,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "2.19.0";
   format = "wheel";
 
+  __structuredAttrs = true;
+
   src = fetchPypi {
     pname = "bitbake_setup";
     inherit (finalAttrs) version;

pkgs/by-name/bi/bitcoin-knots/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     installShellFiles
     gnupg
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     darwin.autoSignDarwinBinariesHook
   ]
   ++ lib.optionals withGui [

pkgs/by-name/bi/bitcoin/package.nix

@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     installShellFiles
     gnupg
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     autoSignDarwinBinariesHook
   ]
   ++ lib.optionals withGui [ qt6.wrapQtAppsHook ];

pkgs/by-name/bl/blazesym-c/package.nix

@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "blazesym-c";
-  version = "0.1.11";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "blazesym";
     tag = "capi-v${finalAttrs.version}";
-    hash = "sha256-WwL/IbR7y916yvFZGdyHlrexqoyr2wDTNalaKMCdnRs=";
+    hash = "sha256-0ceEzlimp6UfrkoEYhwH6RWCrvkCpHF13G9vmM1HbQM=";
   };
 
-  cargoHash = "sha256-uMb45eScPjJV3NXcqr6TMJQZI/IHYY9cXgprG2j4UJA=";
+  cargoHash = "sha256-uQ7buVP0I+RgWHYFZxQP0hwJFMoB7Fz5D7S2dL1d/CM=";
 
   cargoBuildFlags = [
     "--package"

pkgs/by-name/bl/blueprint-compiler/package.nix

@@ -6,26 +6,24 @@
   libadwaita,
   meson,
   ninja,
+  python3,
   runCommand,
   stdenv,
   testers,
   wrapGAppsNoGuiHook,
   xvfb-run,
   gnome,
-  python3Packages,
 }:
-
-python3Packages.buildPythonApplication (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "blueprint-compiler";
-  version = "0.22.2";
-  pyproject = false;
+  version = "0.20.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "blueprint-compiler";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-DRpPUfiufwK2c2RW01IYIX6tgVyxfFl5hnv5F8+9aD4=";
+    hash = "sha256-dA+FQTRmTz6rl5ToZJ8CXY1Zd7Em7VwvF3U3Qoyvu80=";
   };
 
   postPatch = ''
@@ -36,11 +34,17 @@ python3Packages.buildPythonApplication (finalAttrs: {
     gobject-introspection
     meson
     ninja
+    python3
     wrapGAppsNoGuiHook
   ];
 
   buildInputs = [
     libadwaita
+    (python3.withPackages (
+      ps: with ps; [
+        pygobject3
+      ]
+    ))
   ];
 
   propagatedBuildInputs = [
@@ -48,8 +52,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     gobject-introspection
   ];
 
-  dependencies = [ python3Packages.pygobject3 ];
-
   nativeCheckInputs = [
     dbus
     xvfb-run
@@ -68,13 +70,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     runHook postCheck
   '';
 
-  # Prevent double wrapping, let the Python wrapper use the args in preFixup.
-  dontWrapGApps = true;
-
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
   passthru = {
     tests = {
       version = testers.testVersion {

pkgs/by-name/bo/boehmgc/package.nix

@@ -74,8 +74,13 @@ stdenv.mkDerivation (finalAttrs: {
     export NIX_LDFLAGS="$NIX_LDFLAGS -T $TMP/openbsd.ldscript"
   '';
 
-  # `gctest` fails on aarch64-linux under qemu-user.
-  doCheck = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
+  # `gctest` fails under x86_64 emulation on aarch64-darwin
+  # and also on aarch64-linux (qemu-user)
+  doCheck =
+    !(
+      (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64)
+      || (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64)
+    );
 
   enableParallelBuilding = true;
 

pkgs/by-name/bo/borgbackup/package.nix

@@ -33,13 +33,6 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   };
 
   postPatch = ''
-    # Upstream is very sensible about msgpack versions, but the updates to here did not change any relevant code,
-    # so basically backport the essential changes from the bump commits, instead of relaxing the version freely.
-    substituteInPlace src/borg/helpers/msgpack.py \
-      --replace-fail "(1, 2, 1)" "(1, 2, 4)"
-    substituteInPlace pyproject.toml \
-      --replace-fail "<=1.2.1" "<=1.2.4"
-
     # sandbox does not support setuid/setgid/sticky bits
     substituteInPlace src/borg/testsuite/archiver.py \
       --replace-fail "0o4755" "0o0755"
@@ -62,8 +55,11 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   sphinxBuilders = [
-    "singlehtml"
-    "man"
+    # HACK: sphinxBuilders is currently broken with __structuredAttrs = true,
+    # and ignores all but the first array item. for now, pass them as a single
+    # space-separated entry. fixed on staging, but requires a mass-rebuild.
+    # TODO: revert to [ "singlehtml" "man" ] on staging.
+    "singlehtml man"
   ];
 
   buildInputs = [

pkgs/by-name/bo/borgmatic/package.nix

@@ -18,6 +18,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "2.1.7";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchPypi {
     inherit (finalAttrs) pname version;
     hash = "sha256-qsB8564wCWBemsxn7vIBmntdabzK1j7agP8ZK2nzdc8=";

pkgs/by-name/bo/boringssl/package.nix

@@ -58,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "bssl";
     homepage = "https://boringssl.googlesource.com";
     maintainers = with lib.maintainers; [
+      thoughtpolice
+      theoparis
       niklaskorz
     ];
     license = with lib.licenses; [

pkgs/by-name/bp/bpftools/add-128-bit-integer-types-for-aarch64.patch

@@ -1,17 +0,0 @@
-diff --git a/tools/include/uapi/linux/types.h b/tools/include/uapi/linux/types.h
-index 85aa327..adc3543 100644
---- a/tools/include/uapi/linux/types.h
-+++ b/tools/include/uapi/linux/types.h
-@@ -7,6 +7,12 @@
- #ifndef __ASSEMBLER__
- 
- /* copied from linux:include/uapi/linux/types.h */
-+
-+#ifdef __SIZEOF_INT128__
-+typedef __signed__ __int128 __s128 __attribute__((aligned(16)));
-+typedef unsigned __int128 __u128 __attribute__((aligned(16)));
-+#endif
-+
- #define __bitwise
- typedef __u16 __bitwise __le16;
- typedef __u16 __bitwise __be16;

pkgs/by-name/bp/bpftools/package.nix

@@ -27,11 +27,6 @@ stdenv.mkDerivation (finalAttrs: {
     # fix unknown type name '__vector128' on powerpc64*
     # https://www.spinics.net/lists/bpf/msg28613.html
     ./include-asm-types-for-powerpc64.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
-    # Fix unknown type name `__u128` on aarch64, analogous to
-    # https://github.com/libbpf/libbpf/commit/f90a9c487d7542d91fa584b83b6a624a4fbeb341
-    ./add-128-bit-integer-types-for-aarch64.patch
   ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/by-name/br/brotli/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brotli";
-  version = "1.2.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brotli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-llY72cYffDv0ugsH0p89xIPEbElV4L8u7U/Fe8hT3gI=";
+    hash = "sha256-kl8ZHt71v17QR2bDP+ad/5uixf+GStEPLQ5ooFoC5i8=";
   };
 
   patches = [